CVE-2026-100599

Summary

The flaw allows an attacker to execute arbitrary processes on a paired node by bypassing the normal approval flow for Google Meet node commands, posing a significant risk to the security and integrity of the system.

Exploitability

Exploitation is relatively straightforward given the preconditions of a tool-enabled agent and the Google Meet plugin being enabled. The attacker must have the ability to invoke the googlemeet.chrome command.

Blast radius

If exploited, the attacker can impact files, credentials, browser profiles, and availability on the paired node, leading to potential data breaches and system instability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenClaw 2026.7.1 or later to address the vulnerability.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.