CVE-2026-100593

OpenClaw npm package "openclaw" before 2026.7.1 does not enforce the documented owner-only requirement for persistent "/activation" policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond...

CVE-2026-100593

The OpenClaw npm package (openclaw) versions prior to 2026.7.1 fail to enforce an owner-only requirement for persistent /activation policy changes in group channels. This allows an authorized non-owner channel sender to modify whether the agent requires mention-based activation. Consequently, the...

PT-2026-99229

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.7.1 Description The software fails to enforce the owner-only requirement for persistent policy changes via the /activation endpoint in group channels. This allows an authorized sender who is not the owner to...