PT-2026-99165 · Openclaw · Openclaw
CVE-2026-100528
·
Published
2026-09-26
·
Updated
2026-09-26
CVSS v4.0
5.9
Medium
| Vector | AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.8.1
Description
When a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains the provider's credential while the OpenAI SDK selects its own default endpoint. This can result in the disclosure of the configured third-party provider credential to an unrelated provider endpoint, leading to a misleading authentication error.
Recommendations
Update to version 2026.8.1.
Rotate the affected credentials if this condition was observed.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openclaw