CVE-2026-100543

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100543
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100543.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100543
Aliases
  • GHSA-qgj5-6x35-9g6f
Downstream
Published
2026-09-26T02:18:40Z
Modified
2026-09-30T03:30:40Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
Details

OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as offline password verifiers: a caller able to obtain the redacted configuration (for example via config.get) could test password candidates offline without going through the rate-limited Gateway authentication path. Recovering the password could grant the documented shared-secret operator authority. Secret references were not affected in the same way. The issue is fixed in 2026.8.1.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100543.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea806575e6450e4d1efdfc72c19f04be982a1b9b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

Other
release-publish/08987d8f409b-20260717
release-publish/0e9db600595-20260717
release-publish/0e9db6005954-20260717
release-publish/0f7fbfa0039f-20260715
release-publish/10a390ed7fa8-20260802
release-publish/17a1225314cd-1787924262
release-publish/1c80cf86cfd0-1787823217
release-publish/1d2777548d01-20260715
release-publish/2133a924eef0-1787945469
release-publish/21b41efc7bb8-1787818100
release-publish/23d2f664fb75-20260715
release-publish/38fd9ad6e417-1787824804
release-publish/404719374e60-1787933925
release-publish/4074a8b44d89-1787849600
release-publish/45ed68e6ea62-1787220256
release-publish/468054f93c43-1787921799
release-publish/491769bded58-1787929537
release-publish/5090935817e3-1787842724
release-publish/54f70c5d8c04-20260715
release-publish/556a2ee276f0-20260718
release-publish/57fabb2c9c35-1786621048
release-publish/5cb2eee257bc-1787929587
release-publish/5cb2eee257bc-1787929714
release-publish/5dca33a8fb67-20260802
release-publish/62c77b0fb51c-1787927225
release-publish/6ddb9f049fb3-1787938179
release-publish/716f996be8db-1786550775
release-publish/728084497329-20260801
release-publish/73d04395defe-20260717
release-publish/7c9794b5c65c-20260801
release-publish/8371831eba5e-1786610071
release-publish/8858944a81c5-20260717
release-publish/8afa8f339eb6-1787798436
release-publish/9b80f9a8b1df-20260717
release-publish/9bc3c2955500-20260802
release-publish/a33c8a5c0ec6-1787896022
release-publish/a84a915b67bd-1787933964
release-publish/a9ac13b2efd7-20260717
release-publish/abd63c06c2f5-1786646045
release-publish/b3986403ddb9-1787938102
release-publish/bb1a7e506927-20260715
release-publish/bccb649077f0-1787900300
release-publish/c28c279afa37-1787225611
release-publish/c3927271fad7-20260715
release-publish/c96e81375014-1787462685
release-publish/ced50f88e928-20260717
release-publish/d5412d73acfb-1787906286
release-publish/d8b3e1c093f2-20260715
release-publish/d8dd59bf8f60-20260717
release-publish/deffca656500-20260801
release-publish/dfa246e6fd16-20260715
release-publish/e11c566824b1-1787940135
release-publish/eb8c22ed13f9-20260801
release-publish/ebc70fa1b3f6-1787634336
release-publish/f4987deb94b8-1786361493
release-publish/f4f5bb15d46a-20260715
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v1.*
v1.0.4
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v2.*
v2.0.0-beta1
v2.0.0-beta2
v2.0.0-beta3
v2.0.0-beta4
v2.0.0-beta5
v2026.*
v2026.1.10
v2026.1.11
v2026.1.11-1
v2026.1.11-2
v2026.1.11-3
v2026.1.12
v2026.1.12-2
v2026.1.13
v2026.1.14-1
v2026.1.15
v2026.1.16-2
v2026.1.20
v2026.1.21
v2026.1.22
v2026.1.23
v2026.1.24
v2026.1.24-1
v2026.1.29
v2026.1.30
v2026.1.5
v2026.1.5-1
v2026.1.5-2
v2026.1.5-3
v2026.1.8
v2026.1.9
v2026.2.1
v2026.2.12
v2026.2.13
v2026.2.14
v2026.2.15-beta.1
v2026.2.17
v2026.2.19
v2026.2.19-beta.1
v2026.2.2
v2026.2.21
v2026.2.21-beta.1
v2026.2.22
v2026.2.22-beta.1
v2026.2.23
v2026.2.23-beta.1
v2026.2.24
v2026.2.24-beta.1
v2026.2.25
v2026.2.25-beta.1
v2026.2.26
v2026.2.26-beta.1
v2026.2.3
v2026.2.6
v2026.2.6-1
v2026.2.6-2
v2026.2.6-3
v2026.2.9
v2026.3.1
v2026.3.11
v2026.3.11-beta.1
v2026.3.12
v2026.3.13
v2026.3.13-1
v2026.3.2
v2026.3.2-beta.1
v2026.3.22
v2026.3.22-beta.1
v2026.3.23
v2026.3.23-2
v2026.3.23-beta.1
v2026.3.24
v2026.3.24-beta.1
v2026.3.24-beta.2
v2026.3.28
v2026.3.28-beta.1
v2026.3.31
v2026.3.31-beta.1
v2026.3.7
v2026.3.7-beta.1
v2026.3.8
v2026.3.8-beta.1
v2026.4.1
v2026.4.1-beta.1
v2026.4.10
v2026.4.11
v2026.4.11-beta.1
v2026.4.12
v2026.4.12-beta.1
v2026.4.14
v2026.4.14-beta.1
v2026.4.15
v2026.4.15-beta.1
v2026.4.15-beta.2
v2026.4.19-beta.1
v2026.4.19-beta.2
v2026.4.2
v2026.4.5
v2026.4.7
v2026.4.7-1
v2026.4.8
v2026.4.9
v2026.4.9-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100543.json"