Vulnerability Description
OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidden recall paths can retrieve durable memory and inject it into the agent's context even when toolsBySender explicitly denies that requester access to the memory tools (memory_search, memory_get). As a result, an admitted but denied sender can receive information derived from durable memory in the agent's response without directly invoking any memory tool. The issue is fixed in 2026.8.1.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-wjfv-5qch-m5vj
- https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-byp
FAQ
What is CVE-2026-100537?
CVE-2026-100537 is a vulnerability with a CVSS score of 3.1 (LOW). OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together...
How severe is CVE-2026-100537?
CVE-2026-100537 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100537?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.