CVE-2026-100593

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.7.1

Description The software fails to enforce the owner-only requirement for persistent policy changes via the /activation endpoint in group channels. This allows an authorized sender who is not the owner to modify whether the agent requires mention-based activation. Such an action can lead to the agent responding more broadly to group traffic or suppressing expected activation behavior.

Recommendations Update to version 2026.7.1.