CVE-2026-100528: OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint
OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains that provider's credential while the OpenAI SDK selects its own default endpoint. A resulting request could disclose the configured third-party provider credential to an unrelated provider endpoint and fail with a misleading authentication error. Operators who observed this condition should rotate the affected credential. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.8.1 - Operational
Rotate the affected third-party provider credential if this condition was observed.
Event History
Frequently Asked Questions
Which deployments are exposed to this credential disclosure?
Exposure requires a third-party provider using an OpenAI-compatible API, resolved model metadata without a concrete base URL, and a pinned session that continues after a model-configuration hot reload. Deployments not meeting these conditions are not described as affected.
What must happen for the credential to be sent to the wrong endpoint?
After the configuration hot reload, the pinned session must retain the third-party provider credential while the OpenAI SDK selects its own default endpoint. A resulting request can then send that credential to an unrelated provider endpoint.
What should operators do if they observed this condition?
Rotate the affected third-party provider credential. Upgrade OpenClaw to version 2026.8.1, which fixes the issue.
How might an affected request appear operationally?
It may fail with a misleading authentication error, even though the underlying issue is that the credential was sent to an unrelated provider endpoint.