CVE-2026-100534
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.
Kelemahan
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.
Referensi
Temukan bug sebelum penyerang menemukannya.
Masuk dengan GitHub dan jalankan audit pertama Anda dalam waktu kurang dari satu menit. Paket gratis tidak memerlukan kartu kredit.