Authorization Bypass in OpenClaw Affects Non-Owner Channels

CVE-2026-100595

What is CVE-2026-100595?

OpenClaw, prior to version 2026.7.1, is susceptible to an authorization bypass vulnerability. This flaw enables non-owner channel senders to unjustly access diagnostic bundles that are restricted to owners. Attackers can exploit this vulnerability to retrieve sensitive information about the host, including configurations, runtime details, and connected services, which should only be available to authorized personnel. This issue poses a significant risk by exposing confidential data that could be misused.

References