CVE-2026-100579

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1

Description The software incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments, which are authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can provide another sender's identifier to the channel authorization checks. This allows the caller to invoke a channel action using a spoofed requester identity, enabling access to operations that the channel adapter would normally deny to the actual caller. The impact varies based on the enabled channel, the action performed, and the permissions of the target account.

Recommendations Update to version 2026.7.1. Restrict message.action to administrators. Disable sensitive channel actions that rely on requester identity.