AI Threat AlertCVE-2026-100585: OpenClaw: owner-only approval bypass in MCP bridge
HIGHOpenClaw (npm `openclaw`) versions before 2026.7.1 do not verify that the person approving a Claude Code permission prompt is the owner, so any non-owner with channel command access can approve or deny actions meant for the owner. The agent's requested action then runs without owner consent, and the real impact depends on the host capabilities that run was granted, which can include file access and command execution. The exploitation signals are weak so far: the EPSS score is 0.00193, though that sits in the top 92% by percentile. There is no public exploit, no Nuclei template, it is not in CISA KEV, and CISA SSVC says TRACK. The CVSS is 8.0 and requires low privileges plus user interaction, because a pending prompt has to exist. Upgrade to 2026.7.1 or later. Until then, restrict who can send commands in the shared channels connected to OpenClaw and review the permissions granted to Claude Code runs. No dependent counts or Scorecard data were available, so exposure is unquantified.
What is the risk?
Medium-high. The flaw is a missing authorization check (CWE-862) reachable over the network at low complexity, but it needs an authenticated channel member and a pending permission request. Exploitation likelihood is currently low: there is no public exploit or KEV listing, the SSVC decision is TRACK, and EPSS is 0.00193 (top 92% by percentile). Impact is rated high for confidentiality, integrity and availability because approval gates the agent's host-level actions. Risk grows with the number of non-owner users in the channel and with the privileges given to the agent. Dependent and package-health data are unavailable, so wider exposure is not quantified.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Claude Code | npm | — | No patch |
| OpenClaw | pip | — | No patch |
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade
openclawto 2026.7.1 or later.Until patched, limit channel command access to trusted owners only, or disable the MCP channel bridge for Claude Code permission prompts.
Run Claude Code with least-privilege permissions, using sandboxing, a restricted file system scope and no unattended approvals.
Review channel membership and command-access roles for unexpected non-owner users.
Check logs for permission approvals or denials made by non-owner identities, and look for unusual Claude Code actions.
Alert on tool invocations that run without matching owner approval.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-100585?
OpenClaw (npm `openclaw`) versions before 2026.7.1 do not verify that the person approving a Claude Code permission prompt is the owner, so any non-owner with channel command access can approve or deny actions meant for the owner. The agent's requested action then runs without owner consent, and the real impact depends on the host capabilities that run was granted, which can include file access and command execution. The exploitation signals are weak so far: the EPSS score is 0.00193, though that sits in the top 92% by percentile. There is no public exploit, no Nuclei template, it is not in CISA KEV, and CISA SSVC says TRACK. The CVSS is 8.0 and requires low privileges plus user interaction, because a pending prompt has to exist. Upgrade to 2026.7.1 or later. Until then, restrict who can send commands in the shared channels connected to OpenClaw and review the permissions granted to Claude Code runs. No dependent counts or Scorecard data were available, so exposure is unquantified.
Is CVE-2026-100585 actively exploited?
No confirmed active exploitation of CVE-2026-100585 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-100585?
1. Upgrade `openclaw` to 2026.7.1 or later. 2. Until patched, limit channel command access to trusted owners only, or disable the MCP channel bridge for Claude Code permission prompts. 3. Run Claude Code with least-privilege permissions, using sandboxing, a restricted file system scope and no unattended approvals. 4. Review channel membership and command-access roles for unexpected non-owner users. 5. Check logs for permission approvals or denials made by non-owner identities, and look for unusual Claude Code actions. 6. Alert on tool invocations that run without matching owner approval.
What systems are affected by CVE-2026-100585?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP channel bridges, chat-integrated coding agents, human-in-the-loop approval workflows.
What is the CVSS score for CVE-2026-100585?
CVE-2026-100585 has a CVSS v3.1 base score of 8.0 (HIGH). The EPSS exploitation probability is 0.19%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0053AI Agent Tool InvocationAML.T0108AI AgentCompliance Controls Affected
What are the technical details?
Original Advisory
OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request intended for the owner, causing the requested action to proceed without owner consent. The practical impact depends on the pending action and the host capabilities requested by the Claude Code run. The issue is fixed in version 2026.7.1.
Exploitation Scenario
A contractor or low-privileged teammate in a shared chat channel connected to OpenClaw has command access but is not the owner. The owner starts a Claude Code run that asks permission to execute a shell command or write files on the host. The non-owner sees the pending request and sends the approve command through the channel. OpenClaw does not enforce owner-only authorization, so it accepts the approval and the action proceeds. The attacker can nudge the run to request broader capabilities and approve them too, leading to file access, credential exposure or code execution on the host.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-221729.9OpenClaw: WebSocket scope self-elevation grants admin
Same package: openclawCVE-2026-335799.9OpenClaw: scope bypass escalates low-priv to admin
Same package: openclawCVE-2026-329229.9OpenClaw: privilege escalation to RCE via token scope bypass
Same package: openclawCVE-2026-307419.8OpenClaw: RCE via request-side prompt injection
Same package: openclawCVE-2026-320389.8OpenClaw: sandbox bypass enables container lateral movement
Same package: openclaw