CVE-2026-100534 OpenClaw CVE debrief

Who should care

Defenders responsible for OpenClaw deployments, especially those using webhook TaskFlow cancellation, should assess their configurations to prevent potential unauthorized session cancellation.

Why it matters

Defenders should care about CVE-2026-100534 because it involves an authorization bypass vulnerability in OpenClaw's webhook TaskFlow cancellation, potentially allowing attackers to cancel unrelated sessions. This could disrupt critical workflows or services, and defenders need to verify their configurations to prevent unauthorized use.

• Potential unauthorized cancellation of ACP or subagent work outside the route's configured authority.
• Possible disruption of critical workflows or services relying on OpenClaw.
• Need for verification of OpenClaw versions and configurations to ensure proper authorization.

Technical summary

The vulnerability is caused by an authorization bypass in webhook TaskFlow cancellation, allowing attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority. This issue affects OpenClaw versions before 2026.8.1 and can be mitigated by verifying OpenClaw versions and configurations, especially those using webhook TaskFlow cancellation, to prevent potential unauthorized session cancellation.

Defensive priority

Defenders should prioritize verifying OpenClaw versions and configurations, especially those using webhook TaskFlow cancellation, to prevent potential unauthorized session cancellation.

Recommended defensive actions

• Verify OpenClaw versions and configurations to ensure webhook TaskFlow cancellation is properly authorized.
• Restrict access to webhook route secrets to prevent unauthorized use.
• Monitor for potential unauthorized session cancellation attempts.
• Review OpenClaw deployment configurations for exposed systems.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with a CVSS score of 2.3 and a LOW severity rating. The vulnerability is described as an authorization bypass in webhook TaskFlow cancellation, allowing attackers to cancel unrelated sessions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.