PT-2026-99204 · Openclaw · Openclaw

Whyiug

·

CVE-2026-100568

·

Published

2026-09-26

·

Updated

2026-09-26

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1
Description Insufficient access restrictions to operator command cron jobs allow model-visible agent callers to read and execute ownerless command jobs. This allows attackers to inspect stored environment variables and force-run disabled or unscheduled command jobs to access secrets and execute operator-authored commands.
Recommendations Update to version 2026.8.1.

Exploit

Fix

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-100568
GHSA-HPG5-CQ3M-PHQP

Affected Products

Openclaw