CVE-2026-100545: OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
OpenClaw (npm package openclaw) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filename generation was enabled for an agent reachable by lower-trust senders, model-mediated instructions could cause the helper to invoke tools outside that sender's effective policy; the demonstrated impact was the creation of persistent scheduled work. Exploitability depends on the model acting on the injected instruction and on which tools the helper exposes. The issue is fixed in 2026.8.1; as a workaround, disable session-memory filename generation for agents reachable by lower-trust senders.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.8.1 - Configuration
Disable session-memory filename generation for agents reachable by lower-trust senders.
OpenClaw session-memory filename generation = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments are those running OpenClaw before 2026.8.1 with session-memory filename generation enabled on an agent that lower-trust senders can reach. Exposure also depends on the helper retaining tools that the sender's policy would otherwise remove.
What must an attacker be able to do to exploit it?
A lower-trust sender must be able to provide model-mediated instructions to a reachable agent. Successful exploitation additionally depends on the model acting on those instructions and on the tools exposed by the embedded filename-generation helper.
What can be done if upgrading is not immediately possible?
Disable session-memory filename generation for agents reachable by lower-trust senders. This prevents the vulnerable filename-generation path from being used.
What impact was demonstrated?
The demonstrated impact was creation of persistent scheduled work through tools that were outside the originating sender's effective policy.