CVE-2026-100548: OpenClaw Credential Exposure Vulnerability

CVE-2026-100548 Overview

CVE-2026-100548 affects the OpenClaw npm package (openclaw) in versions >= 2026.3.28 and < 2026.8.1. The flaw exposes API credentials when the memory embedding subsystem fails over between remote providers. If the primary embedding provider fails, OpenClaw forwards the request to a configured fallback provider while reusing the primary provider's API key as a bearer token. This transmits the credential to an unintended third-party vendor. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Primary provider API keys can be leaked to an unrelated fallback embedding vendor, enabling that vendor (or anyone intercepting the request) to reuse those credentials against the primary provider's API with full configured privileges.

Affected Products

OpenClaw npm package openclaw versions >= 2026.3.28
OpenClaw npm package openclaw versions < 2026.8.1
Deployments using cross-provider remote embedding fallback

Discovery Timeline

2026-09-26 - CVE-2026-100548 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100548

Vulnerability Analysis

OpenClaw supports pluggable remote embedding providers for its memory subsystem. Administrators can configure a primary provider and a fallback provider to improve availability. When the primary provider returns an error, the client logic routes the embedding request to the fallback endpoint. The credential selection logic does not re-bind the API key to the destination provider. The HTTP client continues to attach the primary provider's bearer token to the outbound request directed at the fallback vendor. The receiving vendor logs the request and the attached authorization header. The leaked credential retains every privilege granted on the primary provider account, including embedding, inference, billing, and model access scopes.

Root Cause

The root cause is a credential-scoping defect in the failover path. Authentication state is coupled to the request object instead of the destination provider. When the destination URL is swapped during failover, the authorization header is not re-evaluated against the target. This matches the [CWE-200] pattern of sensitive data flowing to an unauthorized actor through improper trust boundaries.

Attack Vector

Exploitation requires that cross-provider embedding fallback is enabled and that the primary provider becomes unavailable or returns a failure. An attacker who controls or observes the fallback endpoint receives the primary provider's bearer token. The attacker can also induce failover by degrading the primary provider endpoint from the network path. Once collected, the leaked token can be replayed against the primary provider's API from any network location.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-66hm-hxq3-5pfh and the VulnCheck Credential Exposure Advisory for additional technical context.

Detection Methods for CVE-2026-100548

Indicators of Compromise

Outbound HTTPS requests from OpenClaw hosts to an embedding provider endpoint carrying an Authorization: Bearer header issued by a different provider.
Embedding provider dashboards showing API key usage originating from unexpected source IPs or user agents.
Audit log entries in the primary embedding provider indicating anomalous model, region, or billing activity.

Detection Strategies

Inventory OpenClaw deployments and identify installations within the vulnerable range >= 2026.3.28, < 2026.8.1.
Inspect OpenClaw configuration files for enabled cross-provider embedding fallback and shared credentials across providers.
Correlate egress traffic from application servers to all configured embedding provider domains and alert on unexpected destinations following provider errors.

Monitoring Recommendations

Enable detailed request logging on the primary embedding provider and review for key use from unknown clients.
Rotate any API keys that were in use while vulnerable OpenClaw versions were deployed with fallback enabled.
Monitor billing and rate-limit telemetry on primary provider accounts for unexplained spikes.

How to Mitigate CVE-2026-100548

Immediate Actions Required

Upgrade the openclaw npm package to version 2026.8.1 or later.
Rotate the API keys of any primary embedding provider whose credentials may have been forwarded during failover.
Disable cross-provider embedding fallback until upgrade and key rotation are complete.

Patch Information

The fix is available in openclaw version 2026.8.1. The patched release corrects the credential-binding logic so that each outbound embedding request carries only the API key associated with the destination provider. Review the GitHub Security Advisory GHSA-66hm-hxq3-5pfh for the full change set and upgrade notes.

Workarounds

Disable cross-provider embedding fallback in the OpenClaw configuration.
Issue separate, narrowly scoped credentials for each embedding provider so that a leak cannot grant privileges on another vendor's account.
Restrict egress from OpenClaw hosts to the specific embedding provider domains that are intentionally in use.

bash

# Upgrade to the fixed release
npm install openclaw@2026.8.1

# Verify installed version
npm ls openclaw