CVE-2026-100534

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's...

CVE-2026-100534: Authorization Bypass Through User-Controlled Key

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's...

PT-2026-99171

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An authorization bypass exists in the webhook TaskFlow cancellation process. An attacker possessing a webhook route secret can provide an arbitrary child session key to cancel ACP or subagent wor...