High
OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester
Type: advisorySource: Official CVE List
OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentication modes that honor caller identity and narrower operat…
Products: OpenClawCVEs: CVE-2026-100579