CVE-2026-100528: OpenClaw Credential Disclosure Vulnerability

CVE-2026-100528 Overview

CVE-2026-100528 is a credential disclosure vulnerability in the OpenClaw npm package (openclaw) in versions before 2026.8.1. The flaw occurs when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL. After a model configuration hot reload, a pinned session retains the third-party provider's credential while the OpenAI SDK selects its own default endpoint. The resulting request transmits the configured provider credential to an unrelated endpoint and fails with a misleading authentication error. The issue is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Third-party provider API credentials can be transmitted to an unrelated OpenAI default endpoint, exposing the secret to an unintended party and requiring credential rotation.

Affected Products

OpenClaw npm package (openclaw) versions prior to 2026.8.1
Deployments configuring third-party providers with OpenAI-compatible APIs
Sessions that persist across model configuration hot reloads

Discovery Timeline

2026-09-26 - CVE-2026-100528 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100528

Vulnerability Analysis

The vulnerability arises in OpenClaw's handling of pinned sessions following a model configuration hot reload. When a third-party provider is configured with an OpenAI-compatible API, the package relies on resolved model metadata to determine the correct base URL for outbound requests. If that metadata lacks a concrete base URL, the OpenAI SDK falls back to its own default endpoint rather than the operator-configured third-party endpoint.

The session retains the previously bound credential belonging to the third-party provider. The subsequent request therefore sends that credential to an endpoint owned by a different provider. The receiving endpoint rejects the request and returns an authentication error that obscures the actual condition, which is credential leakage to an unintended party.

The CWE-200 classification reflects unintended exposure of sensitive information. Any operator who observed authentication errors in this configuration should treat the affected API key as compromised and rotate it.

Root Cause

The root cause is the loss of binding between a session's credential and its destination endpoint across a hot reload. When metadata reconciliation drops the base URL, the credential state is preserved while the endpoint state defaults to the OpenAI SDK's built-in value. This creates a credential-destination mismatch inside long-lived sessions.

Attack Vector

Exploitation does not require a traditional attacker action. The condition occurs during normal operation of a vulnerable OpenClaw instance when a model configuration hot reload is triggered while a session is pinned to a third-party provider with incomplete metadata. The resulting outbound request leaks the credential to the OpenAI default endpoint. User interaction with the configuration reload path and specific environmental preconditions make the attack complexity high and limit scalability.

No verified exploit code or public proof of concept is listed in the referenced advisories. See the GitHub Security Advisory GHSA-vhpg-cq3w-v8p9 and the VulnCheck Advisory on OpenClaw for upstream technical detail.

Detection Methods for CVE-2026-100528

Indicators of Compromise

Authentication failures from OpenAI default endpoints (for example, api.openai.com) in logs for sessions that were configured to use a third-party provider.
Outbound TLS connections from OpenClaw workloads to OpenAI endpoints when operator policy specifies a different provider.
Audit records showing a model configuration hot reload immediately preceding anomalous authentication errors.

Detection Strategies

Correlate OpenClaw application logs with egress proxy or network flow logs to identify requests routed to endpoints that do not match the configured provider.
Alert on OpenAI SDK authentication failures originating from workloads where no OpenAI credential has been provisioned.
Review session telemetry around model configuration reload events for destination endpoint mismatches.

Monitoring Recommendations

Monitor the installed version of the openclaw npm package across build pipelines and container images, and flag any version below 2026.8.1.
Instrument outbound HTTP client calls to log the resolved base URL and the provider identifier bound to each session.
Forward application and egress logs to a central analytics tier so authentication errors can be correlated with destination endpoints and reload events.

How to Mitigate CVE-2026-100528

Immediate Actions Required

Upgrade the openclaw npm package to version 2026.8.1 or later across all affected environments.
Rotate any third-party provider API credentials that were in use by OpenClaw while the vulnerable version was deployed, especially where authentication errors from OpenAI endpoints were observed.
Audit outbound request logs for prior credential transmissions to unintended endpoints and document any confirmed exposure.

Patch Information

The maintainers fixed the issue in OpenClaw 2026.8.1. Full technical detail is published in the GitHub Security Advisory GHSA-vhpg-cq3w-v8p9 and summarized in the VulnCheck Advisory on OpenClaw. Operators should pin dependency manifests to the fixed version and rebuild downstream artifacts.

Workarounds

Ensure every third-party provider configuration includes a concrete, explicit base URL so the OpenAI SDK does not fall back to its default endpoint.
Avoid model configuration hot reloads on vulnerable versions, and restart the service to apply configuration changes instead.
Restrict egress from OpenClaw workloads to only the provider endpoints required by policy, blocking unintended destinations at the network layer.

bash

# Upgrade OpenClaw to the fixed version
npm install openclaw@2026.8.1

# Verify the installed version
npm ls openclaw