CVE-2026-100587: OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Which deployments should be considered affected?
OpenClaw versions before 2026.7.1 are affected. Deployments running 2026.7.1 or later are not identified as affected by the provided advisory information.
Does exploitation require owner-level authorization?
No. A non-owner channel sender can exploit the authorization failure in the Codex computer-use installation command.
What should teams do to remediate this issue?
Upgrade affected OpenClaw installations to version 2026.7.1. The provided information does not specify an alternative workaround if upgrading cannot be performed immediately.