OpenClaw Gateway Vulnerability in Active Memory Control by OpenClaw

CVE-2026-100591

What is CVE-2026-100591?

OpenClaw, an npm-distributed agent gateway, contained a vulnerability that allowed authorized non-owner external-channel senders to manipulate the global Active Memory toggle without appropriate owner checks. This issue enabled users to toggle memory recall settings on the Gateway, potentially disrupting expected behavior for future sessions. Specifically, the global on/off mutations were vulnerable, while session-level controls remained unaffected. This vulnerability was addressed in version 2026.7.1, ensuring proper authorization checks are enforced.

References