CVE-2026-100588

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1

Description The software fails to enforce the administrator scope requirement for browser control when accessed via the node.invoke method, despite direct browser.request access requiring such scope. In Gateway deployments that utilize caller identity and narrow operator scopes, a caller with write-scope access to a browser-capable node can inspect pages, navigate tabs, or interact with browser-visible applications without administrator privileges. The actual impact depends on the browser profile and the current signed-in state. Callers using shared-secret tokens or passwords are not affected as they are treated as fully trusted operators.

Recommendations Update to version 2026.7.1.