CVE-2026-100587: OpenClaw Privilege Escalation Vulnerability

CVE-2026-100587 Overview

CVE-2026-100587 is a missing authorization vulnerability [CWE-862] in OpenClaw versions before 2026.7.1. The flaw resides in the Codex computer-use installation command, which fails to validate owner authorization before executing. Non-owner channel senders can install arbitrary plugins and spawn Model Context Protocol (MCP) processes with the privileges of the OpenClaw user. Successful exploitation compromises host confidentiality, integrity, and availability on systems running the affected agent.

Critical Impact
Any authenticated channel sender can install arbitrary plugins and execute MCP processes under the OpenClaw user account, achieving full host-level code execution.

Affected Products

OpenClaw versions prior to 2026.7.1
Codex computer-use installation command component
MCP process execution subsystem

Discovery Timeline

2026-09-26 - CVE CVE-2026-100587 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100587

Vulnerability Analysis

The vulnerability stems from an authorization bypass in OpenClaw's Codex computer-use installation command handler. The command processes install requests from channel senders without verifying that the requester holds the owner role. This design gap maps to CWE-862: Missing Authorization.

Once the install command executes, the attacker's payload is installed as a plugin. The plugin then launches MCP processes that inherit the OpenClaw user's privileges. Because MCP processes can invoke host-level operations, the attacker gains the ability to read sensitive files, modify application state, and disrupt service availability.

The EPSS score for CVE-2026-100587 is 0.246%, reflecting a low near-term exploitation probability despite the network attack surface.

Root Cause

The Codex computer-use installation handler omits an owner-role check before dispatching plugin installation and MCP process creation. Authorization is implicitly assumed from the presence of a channel session rather than enforced against the actual sender identity. Any sender with channel-level access, regardless of ownership, can trigger the install path.

Attack Vector

An attacker needs network reachability to the OpenClaw channel interface and a low-privilege sender account on that channel. The attacker issues a Codex install command referencing an arbitrary plugin. OpenClaw installs the plugin and starts the associated MCP process under its service user, giving the attacker arbitrary code execution scoped to that account.

No verified exploit code is publicly available. For technical details, consult the GitHub Security Advisory GHSA-pjjr-5qhr-5w6r and the VulnCheck Advisory for OpenClaw.

Detection Methods for CVE-2026-100587

Indicators of Compromise

Unexpected plugin files appearing in OpenClaw's plugin directory outside normal maintenance windows.
MCP process executions spawned by the OpenClaw user with command lines referencing newly installed plugins.
Codex install command invocations originating from channel senders that are not registered owners.
Outbound network connections from MCP processes to unfamiliar hosts or package registries.

Detection Strategies

Audit OpenClaw application logs for Codex install command events and correlate the sender identity against the channel owner roster.
Hunt for process-tree anomalies where the OpenClaw service account launches MCP child processes shortly after install events.
Compare installed plugin inventory against an approved allowlist on a scheduled basis.

Monitoring Recommendations

Enable verbose logging on the Codex command handler and forward events to a centralized SIEM.
Alert on any plugin installation that is not preceded by a change ticket or administrative session.
Track file integrity on the OpenClaw plugin directory and configuration files.

How to Mitigate CVE-2026-100587

Immediate Actions Required

Upgrade OpenClaw to version 2026.7.1 or later across all deployments.
Inventory channel sender accounts and remove or restrict non-owner identities with install access.
Review plugin directories and MCP process histories for unauthorized installations prior to patching.
Run the OpenClaw service under a least-privilege account to limit blast radius if the flaw is retriggered.

Patch Information

The vendor fix is included in OpenClaw release 2026.7.1. Refer to the GitHub Security Advisory GHSA-pjjr-5qhr-5w6r for release notes and upgrade guidance.

Workarounds

Restrict network access to the OpenClaw channel interface to trusted administrative networks only.
Disable the Codex computer-use installation command in configuration if patching cannot be performed immediately.
Enforce out-of-band approval for plugin installations through a change-control process.

bash

# Verify installed OpenClaw version meets the fixed release
openclaw --version
# Expected output: 2026.7.1 or later