CVE-2026-100528

The OpenClaw npm package (openclaw ) versions prior to 2026.8.1 are vulnerable to a credential disclosure flaw. When using a third-party provider with an OpenAI-compatible API that lacks a concrete base URL in its metadata, a pinned session following a model configuration hot reload may retain th...