CVE-2026-100540: OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw Feishuto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using OpenClaw Feishu before 2026.8.1 are exposed when they have a multi-account configuration in which the configured default account is disabled but still retains credentials.
What does an attacker need to exploit this issue?
The attacker needs a situation where model tool operations select a disabled configured default Feishu account whose credentials remain available. Exploitation requires low privileges and does not require user interaction, but the attack complexity is high.
What can happen if exploitation succeeds?
An attacker can use the revoked identity's retained credentials to read or modify Feishu resources. The reported impact includes high confidentiality and integrity impact, with no availability impact.
How can teams assess whether they are affected?
Review Feishu multi-account configurations for a default account that has been disabled. Determine whether that disabled account still has credentials configured or otherwise retained for model tool operations.