Vulnerability-Lookup

CNVD-2026-39828

Vulnerability from cnvd - Published: 2026-10-10

Title

OpenClaw授权问题漏洞（CNVD-2026-39828）

Description

OpenClaw是一款由奥地利开发者彼得·斯坦伯格创建的开源AI智能体。 OpenClaw存在授权问题漏洞，，该漏洞源于会话派生文本持久化到会话内存时丢失原始请求者的限制和不可信来源，受限外部发送者可在启用会话内存捕获和dreaming的部署中持久化指令，随后这些指令被提供给具有更广泛文件和命令权限的后台dreaming代理，攻击者可利用该漏洞导致后台代理在无监督情况下执行超出原会话权限的操作，从而影响文件、命令或服务。

Severity

高

Patch Name

OpenClaw授权问题漏洞（CNVD-2026-39828）的补丁

Patch Description

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23

Reference

https://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23 https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-privilege-escalation-via-session-memory

Impacted products

Name
OpenClaw OpenClaw >=2026.4.5，<2026.8.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-100535",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-100535"
    }
  },
  "description": "OpenClaw\u662f\u4e00\u6b3e\u7531\u5965\u5730\u5229\u5f00\u53d1\u8005\u5f7c\u5f97\u00b7\u65af\u5766\u4f2f\u683c\u521b\u5efa\u7684\u5f00\u6e90AI\u667a\u80fd\u4f53\u3002\n\nOpenClaw\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4f1a\u8bdd\u6d3e\u751f\u6587\u672c\u6301\u4e45\u5316\u5230\u4f1a\u8bdd\u5185\u5b58\u65f6\u4e22\u5931\u539f\u59cb\u8bf7\u6c42\u8005\u7684\u9650\u5236\u548c\u4e0d\u53ef\u4fe1\u6765\u6e90\uff0c\u53d7\u9650\u5916\u90e8\u53d1\u9001\u8005\u53ef\u5728\u542f\u7528\u4f1a\u8bdd\u5185\u5b58\u6355\u83b7\u548cdreaming\u7684\u90e8\u7f72\u4e2d\u6301\u4e45\u5316\u6307\u4ee4\uff0c\u968f\u540e\u8fd9\u4e9b\u6307\u4ee4\u88ab\u63d0\u4f9b\u7ed9\u5177\u6709\u66f4\u5e7f\u6cdb\u6587\u4ef6\u548c\u547d\u4ee4\u6743\u9650\u7684\u540e\u53f0dreaming\u4ee3\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u540e\u53f0\u4ee3\u7406\u5728\u65e0\u76d1\u7763\u60c5\u51b5\u4e0b\u6267\u884c\u8d85\u51fa\u539f\u4f1a\u8bdd\u6743\u9650\u7684\u64cd\u4f5c\uff0c\u4ece\u800c\u5f71\u54cd\u6587\u4ef6\u3001\u547d\u4ee4\u6216\u670d\u52a1\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-39828",
  "openTime": "2026-10-10",
  "patchDescription": "OpenClaw\u662f\u4e00\u6b3e\u7531\u5965\u5730\u5229\u5f00\u53d1\u8005\u5f7c\u5f97\u00b7\u65af\u5766\u4f2f\u683c\u521b\u5efa\u7684\u5f00\u6e90AI\u667a\u80fd\u4f53\u3002\r\n\r\nOpenClaw\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4f1a\u8bdd\u6d3e\u751f\u6587\u672c\u6301\u4e45\u5316\u5230\u4f1a\u8bdd\u5185\u5b58\u65f6\u4e22\u5931\u539f\u59cb\u8bf7\u6c42\u8005\u7684\u9650\u5236\u548c\u4e0d\u53ef\u4fe1\u6765\u6e90\uff0c\u53d7\u9650\u5916\u90e8\u53d1\u9001\u8005\u53ef\u5728\u542f\u7528\u4f1a\u8bdd\u5185\u5b58\u6355\u83b7\u548cdreaming\u7684\u90e8\u7f72\u4e2d\u6301\u4e45\u5316\u6307\u4ee4\uff0c\u968f\u540e\u8fd9\u4e9b\u6307\u4ee4\u88ab\u63d0\u4f9b\u7ed9\u5177\u6709\u66f4\u5e7f\u6cdb\u6587\u4ef6\u548c\u547d\u4ee4\u6743\u9650\u7684\u540e\u53f0dreaming\u4ee3\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u540e\u53f0\u4ee3\u7406\u5728\u65e0\u76d1\u7763\u60c5\u51b5\u4e0b\u6267\u884c\u8d85\u51fa\u539f\u4f1a\u8bdd\u6743\u9650\u7684\u64cd\u4f5c\uff0c\u4ece\u800c\u5f71\u54cd\u6587\u4ef6\u3001\u547d\u4ee4\u6216\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "OpenClaw\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2026-39828\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "OpenClaw OpenClaw \u003e=2026.4.5\uff0c\u003c2026.8.1"
  },
  "referenceLink": "https://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23\r\nhttps://www.vulncheck.com/advisories/openclaw-before-2026.8.1-privilege-escalation-via-session-memory",
  "serverity": "\u9ad8",
  "submitTime": "2026-10-09",
  "title": "OpenClaw\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2026-39828\uff09"
}

CVE-2026-100535 (GCVE-0-2026-100535)

Vulnerability from cvelistv5 – Published: 2026-09-26 02:18 – Updated: 2026-10-05 14:55

Title

OpenClaw before 2026.8.1 Privilege Escalation via Session Memory

Summary

OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to an unattended background (dreaming) agent holding broader file and command capabilities, allowing actions beyond the authority of the original turn and affecting files, commands, or services available to that agent. Exploitation requires the content to be captured, selected for later processing, and followed by the model. The issue is fixed in 2026.8.1.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-05 14:03 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/openclaw/openclaw/security/adv…	vendor-advisory
https://www.vulncheck.com/advisories/openclaw-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenClaw	OpenClaw	Affected: 2026.4.5 , < 2026.8.1 (semver) Unaffected: 2026.8.1 (semver) cpe:2.3:a:openclaw:openclaw::::::::

Date Public

2026-09-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100535",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T14:03:06.179071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T14:55:04.493Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/openclaw",
          "product": "OpenClaw",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.8.1",
              "status": "affected",
              "version": "2026.4.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2026.8.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2026.8.1",
                  "versionStartIncluding": "2026.4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-09-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw (npm package \u0027openclaw\u0027) versions \u003e= 2026.4.5 and \u003c 2026.8.1 can lose the originating requester\u0027s restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to an unattended background (dreaming) agent holding broader file and command capabilities, allowing actions beyond the authority of the original turn and affecting files, commands, or services available to that agent. Exploitation requires the content to be captured, selected for later processing, and followed by the model. The issue is fixed in 2026.8.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-26T02:18:35.149Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-62qm-6fjj-6g23)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw before 2026.8.1 Privilege Escalation via Session Memory",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-privilege-escalation-via-session-memory"
        }
      ],
      "title": "OpenClaw before 2026.8.1 Privilege Escalation via Session Memory",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-100535",
    "datePublished": "2026-09-26T02:18:35.149Z",
    "dateReserved": "2026-09-26T01:01:36.094Z",
    "dateUpdated": "2026-10-05T14:55:04.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2026-39828

CVE-2026-100535 (GCVE-0-2026-100535)

Tags

Sightings

Nomenclature

Related by attack behaviour