CVE-2026-100598: OpenClaw before 2026.7.1 Approval Binding Logic Error
OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the same conversation. As a result, an approver's reaction to unrelated text could be interpreted as approving or denying a pending host action; the practical impact depends on the pending request, conversation timing, and the actions available to the OpenClaw process. The issue does not change the authority of correctly identified approvers. This is fixed in version 2026.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the npm package openclaw before version 2026.7.1 are affected when they use Signal-based structured approval requests. Exposure requires a pending approval and unrelated outbound messages in the same conversation.
What does an attacker need to exploit the issue?
Exploitation depends on conversation timing: an approver must react to unrelated outbound text while a structured approval request is pending in that conversation. The attacker does not gain approver authority; the reaction is misbound to the pending request.
What is the potential impact?
A reaction to unrelated text may be interpreted as approval or denial of a pending host action. The resulting impact depends on the specific pending request and the actions available to the OpenClaw process.
How can this be remediated?
Upgrade openclaw to version 2026.7.1, which fixes the approval-reaction binding logic.