MinorCritical vulnerability
CVE-2026-100540 (CVSS 7.6)
NVD · officialPublished Sep 26, 2026Risk 23/100
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.
Technical details
CVSS
7.6
AV:NetworkAC:HighPR:LowUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source