Approval Binding Logic Error in OpenClaw npm Package by OpenClaw

CVE-2026-100598

What is CVE-2026-100598?

The OpenClaw npm package prior to version 2026.7.1 features an approval binding logic error, where an approver's reaction to unrelated messages may unintentionally link to a pending structured approval request. This misbinding can lead to confusion regarding an approval or denial of a pending host action based on the timing and context of the conversation. Users should upgrade to version 2026.7.1 to mitigate this risk and ensure proper functionality.

References