CVE-2026-100530: OpenClaw before 2026.8.1 Exec Approval Directory Binding
OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materially different effects.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenClaw deployments using versions before 2026.8.1 are affected when reusable “allow-always” exec approvals are used. The risk applies where the same approved command could have materially different effects when run in another working directory, repository, or against different files.
What does an attacker need to exploit it?
An attacker needs an existing allow-always approval for a command and the ability to cause that command to be run with a different working-directory context. User interaction is required according to the supplied vector.
Are one-time command approvals affected?
The provided information specifically identifies reusable allow-always approvals as the affected approval type. It does not state that one-time approvals are affected.
What can be done if upgrading is not immediately possible?
Avoid creating or relying on reusable allow-always exec approvals, particularly for commands whose behavior depends on the current directory, repository, or files present. Require review of commands in the intended working-directory context.