AI Threat AlertCVE-2026-100587: OpenClaw: missing owner check allows plugin install and MCP execution
HIGHOpenClaw versions before 2026.7.1 do not check that the sender is the owner when handling the Codex computer-use installation command. Any non-owner channel sender with low privileges can therefore install arbitrary plugins and launch MCP processes with the OpenClaw user's privileges. The CVSS score is 8.8 (network, low complexity, no user interaction), and the impact on confidentiality, integrity and availability is high. Exploitation risk today is moderate: EPSS is 0.00246 (about the 85th percentile as reported), there is no public exploit, no Nuclei template, the CVE is not in CISA KEV, and CISA SSVC says TRACK. Still, the package has 549 other CVEs and the flaw is a simple authorization bypass, so weaponization would be easy. Upgrade to 2026.7.1 or later, and until then restrict who can message the agent's channels and review installed plugins and running MCP processes for anything unexpected.
What is the risk?
High. The flaw is a missing authorization check (CWE-862) reachable over the network with low privileges and no user interaction, and it leads to code execution as the OpenClaw user. Exploitation probability is currently modest: low absolute EPSS, no public exploit or scanner template, not in KEV, SSVC TRACK. Exposure depends on how widely agent channels are opened to non-owner participants (shared chat channels, group bots, external integrations). Deployments where the agent runs with broad host access or holds credentials carry the most risk. Confidence: HIGH on the flaw as described by the vendor and VulnCheck advisories, LOW on real-world exploitation, since none is reported.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| OpenClaw | pip | — | No patch |
Do you use OpenClaw? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade OpenClaw to 2026.7.1 or later. 2) Until patched, limit channel membership to trusted owners only, or disable the Codex computer-use installation command and plugin installation for non-owner senders. 3) Audit installed plugins and MCP server configurations for unexpected entries added since deployment, and remove any you cannot attribute. 4) Review process lists and logs for MCP processes or plugin installs started by non-owner senders. 5) Run OpenClaw under a dedicated low-privilege account, in a container or sandbox, with minimal filesystem and network access. 6) Rotate credentials and API keys reachable by the OpenClaw user if suspicious plugin activity is found. 7) Alert on plugin installation events and new child processes of the OpenClaw runtime.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-100587?
OpenClaw versions before 2026.7.1 do not check that the sender is the owner when handling the Codex computer-use installation command. Any non-owner channel sender with low privileges can therefore install arbitrary plugins and launch MCP processes with the OpenClaw user's privileges. The CVSS score is 8.8 (network, low complexity, no user interaction), and the impact on confidentiality, integrity and availability is high. Exploitation risk today is moderate: EPSS is 0.00246 (about the 85th percentile as reported), there is no public exploit, no Nuclei template, the CVE is not in CISA KEV, and CISA SSVC says TRACK. Still, the package has 549 other CVEs and the flaw is a simple authorization bypass, so weaponization would be easy. Upgrade to 2026.7.1 or later, and until then restrict who can message the agent's channels and review installed plugins and running MCP processes for anything unexpected.
Is CVE-2026-100587 actively exploited?
No confirmed active exploitation of CVE-2026-100587 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-100587?
1) Upgrade OpenClaw to 2026.7.1 or later. 2) Until patched, limit channel membership to trusted owners only, or disable the Codex computer-use installation command and plugin installation for non-owner senders. 3) Audit installed plugins and MCP server configurations for unexpected entries added since deployment, and remove any you cannot attribute. 4) Review process lists and logs for MCP processes or plugin installs started by non-owner senders. 5) Run OpenClaw under a dedicated low-privilege account, in a container or sandbox, with minimal filesystem and network access. 6) Rotate credentials and API keys reachable by the OpenClaw user if suspicious plugin activity is found. 7) Alert on plugin installation events and new child processes of the OpenClaw runtime.
What systems are affected by CVE-2026-100587?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP-based tool integrations, plugin ecosystems, chat-channel-driven AI assistants, computer-use agents.
What is the CVSS score for CVE-2026-100587?
CVE-2026-100587 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.25%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.005AI Agent ToolAML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0112.000Local AI AgentCompliance Controls Affected
What are the technical details?
Original Advisory
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and availability.
Exploitation Scenario
An organization runs an OpenClaw agent in a shared team chat channel with the owner and several other participants. A low-privileged participant, or an external guest with channel access, sends the Codex computer-use install command with a malicious plugin reference. Because the owner check is missing, the agent installs the plugin and starts an attacker-controlled MCP process with the OpenClaw user's privileges. The attacker then reads source code, environment variables and cloud credentials accessible to that user, adds persistent tooling, and can alter the agent's behavior or disrupt it.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-221729.9OpenClaw: WebSocket scope self-elevation grants admin
Same package: openclawCVE-2026-335799.9OpenClaw: scope bypass escalates low-priv to admin
Same package: openclawCVE-2026-329229.9OpenClaw: privilege escalation to RCE via token scope bypass
Same package: openclawCVE-2026-307419.8OpenClaw: RCE via request-side prompt injection
Same package: openclawCVE-2026-320389.8OpenClaw: sandbox bypass enables container lateral movement
Same package: openclaw