CVE-2026-100592: OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming
OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable the Gateway's Memory Core dreaming behavior, disabling background memory processing or re-enabling durable memory promotion where the owner expected it to remain disabled; the practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use. Read-only status and help commands remain governed by normal command policy. The issue is fixed in version 2026.7.1. As a workaround, disable dreaming commands in external channels or restrict channel command access to owners.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.7.1 - Compensating control
Disable '/dreaming on' and '/dreaming off' commands in external channels, or restrict channel command access to owners.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authorized external-channel sender who is not the Gateway owner can exploit it. The sender must be able to issue commands in an external channel; unauthenticated users are not described as affected.
Which deployments are affected?
OpenClaw npm releases from 2026.4.10 up to, but not including, 2026.7.1 are affected. The issue applies where persistent dreaming commands are available to external-channel senders.
What can an attacker do?
A non-owner can send '/dreaming on' or '/dreaming off' to change Memory Core dreaming behavior. This can disable background memory processing or re-enable durable memory promotion when the owner intended it to remain disabled.
What should be done if updating is not immediately possible?
Disable dreaming commands in external channels, or restrict external-channel command access to owners. Update to version 2026.7.1 when possible.
Are read-only memory-related commands also affected?
No. Read-only status and help commands remain subject to the normal command policy.