CVE-2026-100525

Name of the Vulnerable Software and Affected Versions @openclaw/diagnostics-prometheus versions prior to 2026.9.3

Description The authenticated metrics endpoint fails to enforce the operator.read scope. In deployments utilizing identity-bearing Gateway authentication modes, such as trusted-proxy, an authenticated caller without the required read scope can retrieve the diagnostics document. This occurs even when standard read methods correctly reject the identity, leading to the disclosure of operational metrics to profiles with restricted access.

Recommendations Update to version 2026.9.3. Disable the Prometheus endpoint as a temporary workaround. Ensure every identity capable of reaching the endpoint is intended to hold the operator.read scope.