CVE-2026-100562

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1

Description An authorization bypass exists in the 'sessions.create' endpoint. This issue allows users with operator.write permissions to modify session configurations that should be restricted to the operator.admin scope. By manipulating the model, provider, thinking level, and auth-profile variables, an attacker can redirect traffic and circumvent administrative access controls.

Recommendations Update to version 2026.8.1 or later. Restrict the use of the 'sessions.create' endpoint for users with operator.write permissions until the update is applied.