[CVE-2026-100557] OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispat…

Descripción técnica

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners.

Puntuación CVSS

Score: 8.3/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Debilidades (CWE)

CWE-863

Fuente oficial

Publicado en NIST NVD.