Vulnerability-Lookup

CNVD-2026-39827

Vulnerability from cnvd - Published: 2026-10-10

Title

OpenClaw授权问题漏洞（CNVD-2026-39827）

Description

OpenClaw是一款由奥地利开发者彼得·斯坦伯格创建的开源AI智能体。 OpenClaw存在授权问题漏洞，该漏洞源于操作员热禁用内存配置时未能撤销内存工具访问权限，执行时解析器将显式禁用视为不可用配置快照并恢复旧权限，攻击者可利用该漏洞在内存访问权限被撤销后继续读取持久化内存，导致敏感信息泄露。

Severity

低

Patch Name

OpenClaw授权问题漏洞（CNVD-2026-39827）的补丁

Patch Description

OpenClaw是一款由奥地利开发者彼得·斯坦伯格创建的开源AI智能体。 OpenClaw存在授权问题漏洞，该漏洞源于操作员热禁用内存配置时未能撤销内存工具访问权限，执行时解析器将显式禁用视为不可用配置快照并恢复旧权限，攻击者可利用该漏洞在内存访问权限被撤销后继续读取持久化内存，导致敏感信息泄露。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://github.com/openclaw/openclaw/security/advisories/GHSA-chr6-w4m5-57fv

Reference

https://github.com/openclaw/openclaw/security/advisories/GHSA-chr6-w4m5-57fv https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-memory-access-control-bypass

Impacted products

Name
OpenClaw OpenClaw <2026.8.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-100539",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-100539"
    }
  },
  "description": "OpenClaw\u662f\u4e00\u6b3e\u7531\u5965\u5730\u5229\u5f00\u53d1\u8005\u5f7c\u5f97\u00b7\u65af\u5766\u4f2f\u683c\u521b\u5efa\u7684\u5f00\u6e90AI\u667a\u80fd\u4f53\u3002\n\nOpenClaw\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u64cd\u4f5c\u5458\u70ed\u7981\u7528\u5185\u5b58\u914d\u7f6e\u65f6\u672a\u80fd\u64a4\u9500\u5185\u5b58\u5de5\u5177\u8bbf\u95ee\u6743\u9650\uff0c\u6267\u884c\u65f6\u89e3\u6790\u5668\u5c06\u663e\u5f0f\u7981\u7528\u89c6\u4e3a\u4e0d\u53ef\u7528\u914d\u7f6e\u5feb\u7167\u5e76\u6062\u590d\u65e7\u6743\u9650\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5185\u5b58\u8bbf\u95ee\u6743\u9650\u88ab\u64a4\u9500\u540e\u7ee7\u7eed\u8bfb\u53d6\u6301\u4e45\u5316\u5185\u5b58\uff0c\u5bfc\u81f4\u654f\u611f\u4fe1\u606f\u6cc4\u9732\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://github.com/openclaw/openclaw/security/advisories/GHSA-chr6-w4m5-57fv",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-39827",
  "openTime": "2026-10-10",
  "patchDescription": "OpenClaw\u662f\u4e00\u6b3e\u7531\u5965\u5730\u5229\u5f00\u53d1\u8005\u5f7c\u5f97\u00b7\u65af\u5766\u4f2f\u683c\u521b\u5efa\u7684\u5f00\u6e90AI\u667a\u80fd\u4f53\u3002\r\n\r\nOpenClaw\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u64cd\u4f5c\u5458\u70ed\u7981\u7528\u5185\u5b58\u914d\u7f6e\u65f6\u672a\u80fd\u64a4\u9500\u5185\u5b58\u5de5\u5177\u8bbf\u95ee\u6743\u9650\uff0c\u6267\u884c\u65f6\u89e3\u6790\u5668\u5c06\u663e\u5f0f\u7981\u7528\u89c6\u4e3a\u4e0d\u53ef\u7528\u914d\u7f6e\u5feb\u7167\u5e76\u6062\u590d\u65e7\u6743\u9650\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5185\u5b58\u8bbf\u95ee\u6743\u9650\u88ab\u64a4\u9500\u540e\u7ee7\u7eed\u8bfb\u53d6\u6301\u4e45\u5316\u5185\u5b58\uff0c\u5bfc\u81f4\u654f\u611f\u4fe1\u606f\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "OpenClaw\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2026-39827\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "OpenClaw OpenClaw \u003c2026.8.1"
  },
  "referenceLink": "https://github.com/openclaw/openclaw/security/advisories/GHSA-chr6-w4m5-57fv\r\nhttps://www.vulncheck.com/advisories/openclaw-before-2026.8.1-memory-access-control-bypass",
  "serverity": "\u4f4e",
  "submitTime": "2026-10-09",
  "title": "OpenClaw\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2026-39827\uff09"
}

CVE-2026-100539 (GCVE-0-2026-100539)

Vulnerability from cvelistv5 – Published: 2026-09-26 02:18 – Updated: 2026-10-05 14:55

Title

OpenClaw before 2026.8.1 Memory Access Control Bypass

Summary

OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit disablement like an unavailable configuration snapshot and restores the stale authority. As a result, during an already-running agent turn the model can continue searching and reading durable memory after the operator revoked that access, for the remainder of that run. Exploitation requires memory to be disabled while a previously created memory tool remains active. The issue is fixed in 2026.8.1.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

2.6 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-05 14:03 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/openclaw/openclaw/security/adv…	vendor-advisory
https://www.vulncheck.com/advisories/openclaw-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw	Affected: 0 , < 2026.8.1 (semver) Unaffected: 2026.8.1 (semver) cpe:2.3:a:openclaw:openclaw::::::::

Date Public

2026-09-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100539",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T14:03:52.018927Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T14:55:04.358Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/openclaw",
          "product": "OpenClaw",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2026.8.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2026.8.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-09-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw (npm package \u0027openclaw\u0027) before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit disablement like an unavailable configuration snapshot and restores the stale authority. As a result, during an already-running agent turn the model can continue searching and reading durable memory after the operator revoked that access, for the remainder of that run. Exploitation requires memory to be disabled while a previously created memory tool remains active. The issue is fixed in 2026.8.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-26T02:18:37.870Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-chr6-w4m5-57fv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-chr6-w4m5-57fv"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw before 2026.8.1 Memory Access Control Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-memory-access-control-bypass"
        }
      ],
      "title": "OpenClaw before 2026.8.1 Memory Access Control Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-100539",
    "datePublished": "2026-09-26T02:18:37.870Z",
    "dateReserved": "2026-09-26T01:01:36.095Z",
    "dateUpdated": "2026-10-05T14:55:04.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2026-39827

CVE-2026-100539 (GCVE-0-2026-100539)

Tags

Sightings

Nomenclature

Related by attack behaviour