CVE-2026-100562

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-100562

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100562.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-100562

Aliases

GHSA-j4mm-p864-vx7f

Downstream

MINI-p7mc-xhch-hrqx

Published

2026-09-26T02:18:54Z

Modified

2026-10-21T02:54:25Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenClaw before 2026.8.1 Authorization Bypass via sessions.create

Details

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provider, thinking level, and auth-profile settings to redirect traffic and bypass administrative access controls.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100562.json"
}

References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type

GIT

Repo

https://github.com/openclaw/openclaw

Events

Introduced

Fixed

ea806575e6450e4d1efdfc72c19f04be982a1b9b

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2026.8.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2026.8.1"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

Other

release-publish/08987d8f409b-20260717

release-publish/0e9db600595-20260717

release-publish/0e9db6005954-20260717

release-publish/0f7fbfa0039f-20260715

release-publish/10a390ed7fa8-20260802

release-publish/17a1225314cd-1787924262

release-publish/1c80cf86cfd0-1787823217

release-publish/1d2777548d01-20260715

release-publish/2133a924eef0-1787945469

release-publish/21b41efc7bb8-1787818100

release-publish/23d2f664fb75-20260715

release-publish/38fd9ad6e417-1787824804

release-publish/404719374e60-1787933925

release-publish/4074a8b44d89-1787849600

release-publish/45ed68e6ea62-1787220256

release-publish/468054f93c43-1787921799

release-publish/491769bded58-1787929537

release-publish/5090935817e3-1787842724

release-publish/54f70c5d8c04-20260715

release-publish/556a2ee276f0-20260718

release-publish/57fabb2c9c35-1786621048

release-publish/5cb2eee257bc-1787929587

release-publish/5cb2eee257bc-1787929714

release-publish/5dca33a8fb67-20260802

release-publish/62c77b0fb51c-1787927225

release-publish/6ddb9f049fb3-1787938179

release-publish/716f996be8db-1786550775

release-publish/728084497329-20260801

release-publish/73d04395defe-20260717

release-publish/7c9794b5c65c-20260801

release-publish/8371831eba5e-1786610071

release-publish/8858944a81c5-20260717

release-publish/8afa8f339eb6-1787798436

release-publish/9b80f9a8b1df-20260717

release-publish/9bc3c2955500-20260802

release-publish/a33c8a5c0ec6-1787896022

release-publish/a84a915b67bd-1787933964

release-publish/a9ac13b2efd7-20260717

release-publish/abd63c06c2f5-1786646045

release-publish/b3986403ddb9-1787938102

release-publish/bb1a7e506927-20260715

release-publish/bccb649077f0-1787900300

release-publish/c28c279afa37-1787225611

release-publish/c3927271fad7-20260715

release-publish/c96e81375014-1787462685

release-publish/ced50f88e928-20260717

release-publish/d5412d73acfb-1787906286

release-publish/d8b3e1c093f2-20260715

release-publish/d8dd59bf8f60-20260717

release-publish/deffca656500-20260801

release-publish/dfa246e6fd16-20260715

release-publish/e11c566824b1-1787940135

release-publish/eb8c22ed13f9-20260801

release-publish/ebc70fa1b3f6-1787634336

release-publish/f4987deb94b8-1786361493

release-publish/f4f5bb15d46a-20260715

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v1.*

v1.0.4

v1.1.0

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v2.*

v2.0.0-beta1

v2.0.0-beta2

v2.0.0-beta3

v2.0.0-beta4

v2.0.0-beta5

v2026.*

v2026.1.10

v2026.1.11

v2026.1.11-1

v2026.1.11-2

v2026.1.11-3

v2026.1.12

v2026.1.12-2

v2026.1.13

v2026.1.14-1

v2026.1.15

v2026.1.16-2

v2026.1.20

v2026.1.21

v2026.1.22

v2026.1.23

v2026.1.24

v2026.1.24-1

v2026.1.29

v2026.1.30

v2026.1.5

v2026.1.5-1

v2026.1.5-2

v2026.1.5-3

v2026.1.8

v2026.1.9

v2026.2.1

v2026.2.12

v2026.2.13

v2026.2.14

v2026.2.15-beta.1

v2026.2.17

v2026.2.19

v2026.2.19-beta.1

v2026.2.2

v2026.2.21

v2026.2.21-beta.1

v2026.2.22

v2026.2.22-beta.1

v2026.2.23

v2026.2.23-beta.1

v2026.2.24

v2026.2.24-beta.1

v2026.2.25

v2026.2.25-beta.1

v2026.2.26

v2026.2.26-beta.1

v2026.2.3

v2026.2.6

v2026.2.6-1

v2026.2.6-2

v2026.2.6-3

v2026.2.9

v2026.3.1

v2026.3.11

v2026.3.11-beta.1

v2026.3.12

v2026.3.13

v2026.3.13-1

v2026.3.2

v2026.3.2-beta.1

v2026.3.22

v2026.3.22-beta.1

v2026.3.23

v2026.3.23-2

v2026.3.23-beta.1

v2026.3.24

v2026.3.24-beta.1

v2026.3.24-beta.2

v2026.3.28

v2026.3.28-beta.1

v2026.3.31

v2026.3.31-beta.1

v2026.3.7

v2026.3.7-beta.1

v2026.3.8

v2026.3.8-beta.1

v2026.4.1

v2026.4.1-beta.1

v2026.4.10

v2026.4.11

v2026.4.11-beta.1

v2026.4.12

v2026.4.12-beta.1

v2026.4.14

v2026.4.14-beta.1

v2026.4.15

v2026.4.15-beta.1

v2026.4.15-beta.2

v2026.4.19-beta.1

v2026.4.19-beta.2

v2026.4.2

v2026.4.5

v2026.4.7

v2026.4.7-1

v2026.4.8

v2026.4.9

v2026.4.9-beta.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100562.json"