CVE-2026-100591

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1

Description Global Active Memory toggle mutations may omit owner authorization checks. This allows an authorized non-owner external-channel sender to persistently enable or disable Active Memory for the Gateway. Consequently, memory recall for future sessions can be disabled, or global recall can be re-enabled against the owner's expectations. This issue is restricted to persistent global on/off mutations, while session-level controls and read-only status continue to be managed by the existing command policy.

Recommendations Update to version 2026.7.1.