CVE-2026-100542 OpenClaw CVE debrief

Who should care

Defenders responsible for OpenClaw installations and skill archive management should assess exposure and prioritize verification and updates. This includes reviewing OpenClaw versions, validating skill archive installations, and monitoring disk space and inode usage in the skill tools directory. Security teams and operators managing OpenClaw deployments should be aware of the potential for disk space or inode consumption and take steps to mitigate this.

Why it matters

CVE-2026-100542 is a low-severity vulnerability in OpenClaw that allows a crafted skill archive to bypass extraction budgets, potentially consuming disk space or inodes. Defenders should prioritize verifying OpenClaw versions and updating to 2026.8.1 or later.

• Potential disk space consumption
• Potential inode consumption in the skill tools directory
• Verification of OpenClaw versions and updates required
• Monitoring of disk space and inode usage recommended

Technical summary

The OpenClaw npm package 'openclaw' versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer, allowing a crafted .tar.bz2/.tbz2 skill archive to bypass extraction budgets and persist over-limit files or entry counts in the skill tools directory. This occurs because bounded command-output suffixes are treated as complete listings of the archive. A crafted archive can push prohibited entries out of both retained listings, allowing entry-count and size checks to pass. The issue does not by itself execute archive contents but can lead to disk space or inode consumption if a malicious or compromised archive is installed.

Defensive priority

Defenders should prioritize verifying OpenClaw versions and updating to 2026.8.1 or later to prevent potential disk space or inode consumption.

Recommended defensive actions

• Verify OpenClaw versions and update to 2026.8.1 or later
• Monitor disk space and inode usage in the skill tools directory
• Review and validate skill archive installations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The issue is fixed in OpenClaw version 2026.8.1. Evidence is limited to public CVE and NVD records. Defenders should verify OpenClaw versions and update to 2026.8.1 or later to address this vulnerability. No additional information is available beyond the CVE record and NVD detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.