CVE-2026-100539: OpenClaw before 2026.8.1 Memory Access Control Bypass
OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memorysearch and memoryget tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit disablement like an unavailable configuration snapshot and restores the stale authority. As a result, during an already-running agent turn the model can continue searching and reading durable memory after the operator revoked that access, for the remainder of that run. Exploitation requires memory to be disabled while a previously created memory tool remains active. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the npm package openclaw before version 2026.8.1 are affected only when memory is hot-disabled during an already-running agent turn that has previously created memory_search or memory_get tools.
What must happen for the stale memory access to be usable?
A previously created memory tool must remain active after an operator disables memory. The model can then continue to search and read durable memory for the remainder of that running agent turn.
How can the issue be remediated?
Upgrade openclaw to version 2026.8.1, which fixes the access-revocation behavior.
What should operators do if they disable memory during an active run?
The provided information indicates the stale access lasts only for the remainder of the active agent turn. Ending that run prevents the affected tool instance from continuing to use its captured enabled configuration.