Unauthorized Command Job Access in OpenClaw by OpenClaw

CVE-2026-100568

What is CVE-2026-100568?

OpenClaw versions prior to 2026.8.1 contain a security flaw that fails to adequately restrict access to operator command cron jobs. This vulnerability allows model-visible agent callers to read and execute ownerless command jobs, potentially exposing sensitive information. Attackers can exploit this weakness to inspect stored environment variables, enabling them to force-run disabled or unscheduled command jobs. Consequently, this could lead to the unauthorized access of secrets and the execution of command jobs authored by operators, posing significant security risks to affected systems.

References