CVE-2026-100535: OpenClaw before 2026.8.1 Privilege Escalation via Session Memory
OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to an unattended background (dreaming) agent holding broader file and command capabilities, allowing actions beyond the authority of the original turn and affecting files, commands, or services available to that agent. Exploitation requires the content to be captured, selected for later processing, and followed by the model. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use OpenClaw versions from 2026.4.5 through versions before 2026.8.1, and have both session-memory capture and dreaming enabled. The meaningful exposure is where restricted external senders can submit messages and the unattended dreaming agent has broader file or command capabilities.
What must happen for exploitation to succeed?
An external sender's content must be captured into session memory, selected for later dreaming processing, and followed by the model. The attacker needs access as a restricted sender; the advisory does not describe exploitation by an entirely unauthenticated party.
What can an attacker do if exploitation succeeds?
The background dreaming agent can perform actions beyond the authority of the original restricted request. Impact is limited by the files, commands, and services available to that background agent, but can include effects on all three.
What should be done if upgrading cannot happen immediately?
Disable session-memory capture or dreaming to remove the described path between restricted sender content and the higher-privileged background agent. Also avoid allowing restricted external sender content to be persisted for later processing by an agent with broader capabilities.
How can I determine whether I am affected?
Check whether the installed npm openclaw version is at least 2026.4.5 and earlier than 2026.8.1. Then verify whether session-memory capture and dreaming are enabled and whether the dreaming agent has more file, command, or service access than external senders.