Authentication Bypass Vulnerability in OpenClaw by OpenClaw

CVE-2026-100585

What is CVE-2026-100585?

The OpenClaw npm package prior to version 2026.7.1 contains a significant authentication bypass vulnerability. This flaw results from the failure to enforce owner-only authorization for Claude Code permission prompts transmitted through the MCP channel bridge. As a consequence, an authorized non-owner channel sender possessing channel command access can approve or deny permission requests that are intended solely for the owner. This could potentially allow actions to be executed without the required consent from the owner, leading to unauthorized operations that depend on the specific host capabilities and pending action requests. The issue has been mitigated in version 2026.7.1.

References