CVE-2026-100532

Name of the Vulnerable Software and Affected Versions @openclaw/whatsapp versions prior to 2026.8.1

Description The software exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, failing to enforce the owner-only tool boundary. A non-owner sender who can steer the tool may request a forced login and receive a new QR code for a configured account. This action disconnects the Gateway's WhatsApp account, resulting in a loss of availability. Full account relinking would further require the attacker to scan the provided QR code with another phone. This issue specifically impacts the owner-only tool boundary and not the WhatsApp transport authentication.

Recommendations Update to version 2026.8.1.