CVE-2026-100534: OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a webhook route secret. With that secret, they can submit a cancellation request using an arbitrary child session key.
What activity can an attacker disrupt?
The attacker can cancel ACP or subagent work associated with unrelated sessions, including work outside the webhook route's configured authority.
Which versions need remediation?
OpenClaw versions before 2026.8.1 are affected. Upgrade to 2026.8.1 or later.