---
id: CVE-2026-100535
title: >-
  OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose
  the originating requester's restrictions and untrusted provenance when
  session-derived text is persisted to session memory
summary: >-
  OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose
  the originating requester's restrictions and untrusted provenance when
  session-derived text is persisted to session memory. In deployments where
  session-memor…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
vendor: OpenClaw
product: OpenClaw
affected:
  - OpenClaw >= 2026.4.5 < 2026.8.1
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T03:16:59.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100535'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-privilege-escalation-via-session-memory
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T03:25:24.676Z'
---

## Overview

OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to an unattended background (dreaming) agent holding broader file and command capabilities, allowing actions beyond the authority of the original turn and affecting files, commands, or services available to that agent. Exploitation requires the content to be captured, selected for later processing, and followed by the model. The issue is fixed in 2026.8.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.