CVE-2026-100539

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1

Description The software fails to revoke memory tool access when an operator hot-disables memory configuration. This occurs because the execution-time resolver treats explicit disablement as an unavailable configuration snapshot and restores stale authority. Consequently, during an active agent turn, the model may continue searching and reading durable memory after access has been revoked. This issue affects the memory search and memory get tool instances.

Recommendations Update to version 2026.8.1.