CVE-2026-100585

Katalog CVE

CVSS 8.0 · High EPSS 0,19%

Kerentanan Missing Authorization. Skor CVSS 3.1 8.0 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request intended for the owner, causing the requested action to proceed without owner consent. The practical impact depends on the pending action and the host capabilities requested by the Claude Code run. The issue is fixed in version 2026.7.1.

Rincian

Terbit di NVD

26 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

8.0 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-p5g8-m35v-7m82
• https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authentication-bypass-via-mcp-channel