CVE-2026-100562

Summary

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provider, thinking level, and auth-profile settings to redirect traffic and bypass administrative access controls.

Affected Software

VendorProductVersion RangeStatus
OpenClawOpenClaw0 < 2026.8.1affected
OpenClawOpenClaw2026.8.1unaffected

Weaknesses

  • CWE-863: Incorrect Authorization

References