CVE-2026-100545: OpenClaw Privilege Escalation Vulnerability

CVE-2026-100545 Overview

CVE-2026-100545 affects the OpenClaw npm package (openclaw) in versions prior to 2026.8.1. The vulnerability stems from incorrect enforcement of sender tool policies during session-memory filename generation. An embedded helper created during filename generation retains tools that the originating sender's policy had already removed. When session-memory filename generation is enabled for an agent reachable by lower-trust senders, model-mediated instructions can cause the helper to invoke tools outside the sender's effective policy. The demonstrated impact is the creation of persistent scheduled work. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
Lower-trust senders can indirectly invoke tools removed by their policy, enabling creation of persistent scheduled tasks through the session-memory helper.

Affected Products

OpenClaw npm package (openclaw) versions prior to 2026.8.1
Deployments with session-memory filename generation enabled
Agents reachable by lower-trust senders

Discovery Timeline

2026-09-26 - CVE-2026-100545 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100545

Vulnerability Analysis

The flaw lies in how OpenClaw constructs the helper used during session-memory filename generation. The helper inherits a tool set that does not reflect the removals applied by the originating sender's policy. As a result, the sender's effective policy is not honored at the point where the helper executes model-mediated instructions. Attackers who can influence model input through a lower-trust sender channel can direct the helper to invoke restricted tools. The advisory documents persistent scheduled work as the demonstrated outcome, indicating that scheduling-related tools remained reachable through the helper.

Root Cause

The root cause is incorrect authorization enforcement [CWE-863] during an intermediate code path. Sender policy filtering is applied upstream, but the embedded helper constructed for filename generation is initialized with a broader tool inventory. This divergence between the declared sender policy and the helper's runtime tool set creates a policy bypass. The gap exists only when session-memory filename generation is enabled for agents exposed to lower-trust senders.

Attack Vector

Exploitation requires network reachability to an agent that performs session-memory filename generation on behalf of lower-trust input. The attacker injects instructions that the model processes and relays to the helper. The helper then invokes tools the sender should not be permitted to call. Exploitability depends on two conditions: the model acting on the injected instruction and the specific tools exposed to the helper. Attack complexity is elevated because the attacker must shape prompts that reliably trigger the restricted tool invocation.

See the GitHub Security Advisory GHSA-5fwv-rrvp-8xvr and the Vulncheck Policy Bypass Advisory for the full technical write-up.

Detection Methods for CVE-2026-100545

Indicators of Compromise

Unexpected scheduled tasks or persistent jobs created by agent processes using OpenClaw
Tool invocations in agent logs that reference tools excluded by a sender's declared policy
Session-memory filename generation events immediately followed by scheduler or task-creation tool calls
Agent traffic from lower-trust senders correlated with privileged tool executions

Detection Strategies

Audit OpenClaw deployments for versions below 2026.8.1 using package manifests and lockfiles
Compare the tool set declared in sender policies with the tool set observed in helper invocations
Alert on any tool invocation during filename generation that falls outside the sender's effective policy
Review agent telemetry for prompt patterns designed to coerce scheduling or persistence operations

Monitoring Recommendations

Enable verbose logging on agent tool invocations and record the originating sender identity for each call
Centralize agent and scheduler logs for correlation across session-memory and persistence events
Monitor creation of recurring jobs, cron entries, or scheduled workflows attributable to agent sessions
Track upstream dependency versions of openclaw across CI/CD pipelines and runtime inventories

How to Mitigate CVE-2026-100545

Immediate Actions Required

Upgrade openclaw to version 2026.8.1 or later across all environments
Inventory all agents that enable session-memory filename generation and confirm exposure to lower-trust senders
Review recently created scheduled tasks for unauthorized or unexpected entries
Rotate credentials or tokens that may have been accessed through unauthorized tool invocations

Patch Information

The vulnerability is fixed in OpenClaw 2026.8.1. The patch corrects helper initialization so that the embedded helper enforces the originating sender's tool policy. Refer to the GitHub Security Advisory GHSA-5fwv-rrvp-8xvr for release details.

Workarounds

Disable session-memory filename generation for any agent reachable by lower-trust senders
Restrict the tool inventory available to agents that must retain filename generation
Isolate affected agents behind trust boundaries that prevent untrusted model input
Remove scheduling and persistence-capable tools from agents until the upgrade is applied

bash

# Configuration example: upgrade OpenClaw to the fixed release
npm install openclaw@2026.8.1
npm ls openclaw