CVE-2026-100537

LOW 3.1

OpenClaw before 2026.8.1 Authentication Bypass via Active Memory

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidden recall paths can retrieve durable memory and inject it into the agent's context even when toolsBySender explicitly denies that requester access to the memory tools (memory_search, memory_get). As a result, an admitted but denied sender can receive information derived from durable memory in the agent's response without directly invoking any memory tool. The issue is fixed in 2026.8.1.

CWE	CWE-862
Vendor	openclaw
Product	openclaw
Published	Sep 26, 2026

Stay Ahead of the Next One

Get instant alerts for openclaw openclaw

Be the first to know when new low vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

OpenClaw / OpenClaw

0 < 2026.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-wjfv-5qch-m5vj vulncheck.com: https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-bypass-via-active-memory