CVE-2026-100540: OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

Published Sep 26, 2026
·
Updated

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.

Affected Software

1 affected component
OpenClaw Feishu<2026.8.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade OpenClaw Feishu to a version that resolves this vulnerability.

    Fixed in 2026.8.1

Event History

Sep 26, 2026
CVE Published
via MITRE·02:18 AM
Data Sourced
via MITRE·02:18 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed?

Deployments using OpenClaw Feishu before 2026.8.1 are exposed when they have a multi-account configuration in which the configured default account is disabled but still retains credentials.

2

What does an attacker need to exploit this issue?

The attacker needs a situation where model tool operations select a disabled configured default Feishu account whose credentials remain available. Exploitation requires low privileges and does not require user interaction, but the attack complexity is high.

3

What can happen if exploitation succeeds?

An attacker can use the revoked identity's retained credentials to read or modify Feishu resources. The reported impact includes high confidentiality and integrity impact, with no availability impact.

4

How can teams assess whether they are affected?

Review Feishu multi-account configurations for a default account that has been disabled. Determine whether that disabled account still has credentials configured or otherwise retained for model tool operations.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203