CVE-2026-100594

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1

Description An authorization bypass exists in the '/export-trajectory' endpoint, allowing non-owner senders to request and receive trajectory bundles intended only for the owner. This occurs due to insufficient authorization checks, enabling attackers to access prompts, model messages, tool schemas, runtime events, and local path metadata from affected sessions.

Recommendations Update to version 2026.7.1 or later. Restrict access to the '/export-trajectory' endpoint as a temporary mitigation measure.