high8.3
CVE-2026-100557
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status.
Impact
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners.
Affected products
| Product | Affected versions |
|---|---|
| OpenClaw | before 2026.8.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.