CVE-2026-100543 OpenClaw CVE debrief

Who should care

Defenders and administrators using OpenClaw should assess exposure and prioritize upgrading to version 2026.8.1 or later. This involves reviewing system configurations, assessing the risk of offline password verification, and taking appropriate measures to protect against potential exploitation. Security teams should also review and update incident response plans to address potential impacts.

Why it matters

Defenders should prioritize verifying and upgrading to OpenClaw version 2026.8.1 or later due to the risk of offline password verification and potential recovery of Gateway passwords with low entropy.

• Offline password verification could allow attackers to recover Gateway passwords with low entropy
• Recovered passwords could grant shared-secret operator authority
• Configuration and authentication settings should be reviewed for exposure

Technical summary

OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. These hashes could act as offline password verifiers for Gateway passwords with low entropy. This vulnerability allows attackers to test password candidates offline without going through the rate-limited Gateway authentication path, potentially leading to the recovery of Gateway passwords with low entropy and granting shared-secret operator authority.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenClaw version 2026.8.1 or later, and assess exposure of Gateway passwords with low entropy.

Recommended defensive actions

• Verify OpenClaw version and upgrade to 2026.8.1 or later
• Assess exposure of Gateway passwords with low entropy
• Review configuration and authentication settings
• Perform a thorough review of system configurations to identify potential exposure
• Implement additional monitoring to detect potential exploitation attempts
• Conduct a security audit to ensure compliance with best practices
• Review and update incident response plans to address potential impacts

Evidence notes

The CVE record and source references provide details on the vulnerability in OpenClaw before 2026.8.1. The issue involves deterministic hashes in redacted configuration responses that could act as offline password verifiers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.