CVE-2026-100579

The OpenClaw (npm package 'openclaw ') before version 2026.7.1 is vulnerable to an authentication bypass because it incorrectly trusts requester provenance in message.action . In identity-bearing Gateway deployments, a write-scoped caller can provide a different sender's identifier to bypass chan...