CVE-2026-100594CWE-200information-disclosure

CVE-2026-100594

Medium · published September 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
14.4
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadata from affected sessions by exploiting insufficient authorization checks.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00241 · 14.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-26T07:17Z
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-89cw-7452-cfrf · [email protected]https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-trajectory-export · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 26 SEP 02:19Z
    OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
    cvelistv5