MinorCritical vulnerability
CVE-2026-100529 (CVSS 7.4)
NVD · officialPublished Sep 26, 2026Risk 23/100
OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope.
Technical details
CVSS
7.4
AV:NetworkAC:HighPR:LowUI:Passive
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source