CVE-2026-100534

LOW 3.1

OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.

CWE	CWE-639
Vendor	openclaw
Product	openclaw
Published	Sep 26, 2026

Stay Ahead of the Next One

Get instant alerts for openclaw openclaw

Be the first to know when new low vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

OpenClaw / OpenClaw

0 < 2026.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-g24w-m94m-59qc vulncheck.com: https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-session-cancellation-authorization-bypass