CVE-2026-100593Medium· 5.4▾ SunlitOpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An authorized non-owner channel sender can change whether the agent r…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenClaw (npm package openclaw) before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond more broadly in the group (exposing its responses to additional group traffic) or suppressing expected activation behavior until an owner restores the intended setting. The issue is fixed in version 2026.7.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100596High· 8.8OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands
CVE-2026-100592Medium· 6.3OpenClaw is an agent gateway distributed via npm
CVE-2026-100591Medium· 6.3OpenClaw is an npm-distributed agent gateway
CVE-2026-100587High· 8.8OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command
CVE-2026-100585High· 8.0OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge
CVE-2026-100573Low· 3.3OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy