CVE-2026-100529: OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer
OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which existing approvals create exposure?
File-transfer approvals configured as allow-always can become standing grants that are reusable beyond the operator’s originally reviewed path or node scope.
What would an attacker need to exploit this issue?
The CVSS vector indicates network reachability, low privileges, and user interaction are required. Exploitation relies on glob metacharacter interpretation or reuse of a node display name to extend a standing grant to sibling paths or different nodes.
What is the available remediation?
Upgrade to OpenClaw 2026.8.1 or later. Versions before 2026.8.1 are affected.