CVE-2026-100579

Published 26 September 2026 · tracked since 26 September 2026

Description

OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentication modes that honor caller identity and narrower operator scopes), a write-scoped caller can supply another sender's identifier to the cha

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-93348 HIGH 8.1
• CVE-2026-88808 HIGH 8.8
• CVE-2026-101861 MEDIUM 4.1
• CVE-2026-101079 LOW 2.8
• CVE-2026-93539 MEDIUM 5.4
• CVE-2026-96538
• CVE-2026-93537 MEDIUM 6.5
• CVE-2026-82929
• CVE-2026-82935
• CVE-2026-82323 HIGH 8.1

→ Open the live CVE board · all tools