CVE-2026-100595

6.5 MEDIUMpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about the host, configuration, runtime, and connected services intended only for owners.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Public exploit & PoC references

https://github.com/openclaw/openclaw/security/advisories/GHSA-4hwv-rj92-h7rp

All references

https://github.com/openclaw/openclaw/security/advisories/GHSA-4hwv-rj92-h7rp
https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-diagnostics

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100241
UNSCOREDCVE-2026-100244
MEDIUMCVE-2026-100286
UNSCOREDCVE-2026-100377
UNSCOREDCVE-2026-100379PoC
MEDIUMCVE-2026-100418PoC
MEDIUMCVE-2026-100528PoC
HIGHCVE-2026-100543PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.