Authorization Bypass in OpenClaw Affects Session Management

CVE-2026-100562

What is CVE-2026-100562?

OpenClaw prior to version 2026.8.1 is susceptible to an authorization bypass vulnerability specifically located in the sessions.create endpoint. This flaw allows users with write-scoped permissions to alter session configurations that should only be adjustable by users with administrative privileges. As a result, attackers can manipulate critical session settings, including model, provider, thinking level, and authentication profiles. Such changes can facilitate redirection of traffic and enable circumvention of key access controls, presenting significant security risks.

References