4 matches found
CVE-2026-100534
Versions of OpenClaw prior to 2026.8.1 are affected by an authorization bypass vulnerability within the webhook TaskFlow cancellation mechanism. An attacker possessing a webhook route secret can provide an arbitrary child session key to cancel ACP or subagent work that falls outside the route's c...
CVE-2026-100534 OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's...
EUVD-2026-87516
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's...
CVE-2026-100534: Authorization Bypass Through User-Controlled Key
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's...