CVE-2026-100537: OpenClaw Information Disclosure Vulnerability

CVE-2026-100537 Overview

CVE-2026-100537 affects the OpenClaw npm package (openclaw) before version 2026.8.1. The flaw lets an admitted but denied requester receive data derived from durable Active Memory even when toolsBySender explicitly denies access to the memory tools (memory_search, memory_get). OpenClaw fails to apply the originating requester's effective tool policy during automatic Active Memory recall. Deterministic and hidden recall paths bypass per-sender tool rules and inject memory content into the agent's response. The issue is classified as missing authorization [CWE-862] and is fixed in 2026.8.1.

Critical Impact
Senders denied access to memory tools can still receive durable memory content through automatic Active Memory recall paths.

Affected Products

OpenClaw npm package (openclaw) versions prior to 2026.8.1
Deployments using Active Memory with requester-specific tool rules (toolsBySender)
Agents configured to deny memory_search and memory_get to specific senders

Discovery Timeline

2026-09-26 - CVE-2026-100537 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100537

Vulnerability Analysis

OpenClaw implements an Active Memory feature that automatically recalls durable memory to enrich an agent's context. The recall operates through deterministic and hidden paths that run before or outside the normal tool invocation flow. These automatic paths do not consult the per-requester tool policy expressed in toolsBySender. As a result, a sender who is explicitly denied memory_search and memory_get still receives agent responses derived from durable memory content.

This is a missing authorization condition [CWE-862]. The authorization check that governs direct tool invocation is not propagated to the implicit recall layer. The agent therefore leaks memory-derived information without the denied sender ever calling a memory tool.

Root Cause

The root cause is incomplete enforcement of the originating requester's effective tool policy. Active Memory automatic recall executes with ambient privileges rather than the caller's authorization context. The toolsBySender deny list governs explicit tool calls but is not evaluated during hidden recall, breaking the intended per-sender isolation.

Attack Vector

An authenticated requester who is admitted to the agent but denied memory tools interacts normally with the agent. The agent's Active Memory layer transparently retrieves durable memory and injects it into the response context. The denied sender receives information derived from that memory without invoking any memory tool directly. Exploitation requires network access and low privileges, and succeeds only in deployments that pair Active Memory with toolsBySender restrictions.

No verified exploit code is published. See the GitHub Security Advisory GHSA-wjfv-5qch-m5vj and the VulnCheck Advisory on OpenClaw for additional technical context.

Detection Methods for CVE-2026-100537

Indicators of Compromise

Agent responses to denied senders that reference content only present in durable memory stores.
Active Memory recall events logged without a corresponding memory_search or memory_get tool invocation by the requester.
Unexpected context enrichment entries attributed to senders listed in toolsBySender deny rules.

Detection Strategies

Audit OpenClaw deployment manifests for installed openclaw versions prior to 2026.8.1.
Correlate agent response transcripts with memory recall logs to identify responses enriched for denied senders.
Review toolsBySender configurations and test each denied sender against prompts designed to elicit durable memory content.

Monitoring Recommendations

Enable verbose logging on the Active Memory recall subsystem to capture the requester identity for every retrieval.
Alert on any recall event whose requester is present in a deny list for memory_search or memory_get.
Track package versions of openclaw in software bill of materials pipelines and flag versions below 2026.8.1.

How to Mitigate CVE-2026-100537

Immediate Actions Required

Upgrade the openclaw npm package to version 2026.8.1 or later in all affected deployments.
Inventory agents that combine Active Memory with toolsBySender and treat them as exposed until patched.
Rotate or redact any durable memory entries that may have been disclosed to denied senders.

Patch Information

The maintainers fixed the issue in openclaw2026.8.1. The patch applies the originating requester's effective tool policy to Active Memory automatic recall, so deterministic and hidden recall paths honor toolsBySender deny rules. Refer to the GitHub Security Advisory GHSA-wjfv-5qch-m5vj for release details.

Workarounds

Disable Active Memory automatic recall for agents that enforce per-sender tool restrictions until the upgrade is applied.
Remove memory tools from the global tool set when any sender is denied access, eliminating the policy mismatch.
Partition durable memory stores so that sensitive content is not loaded by agents serving mixed-trust senders.

bash

# Upgrade OpenClaw to the patched release
npm install openclaw@2026.8.1
npm ls openclaw