Security Digest: September 26, 2026 - 26 Critical Vulnerabilities

Today’s alert is dominated by high-risk authorization bypasses, command execution flaws, and DNS pinning failures in OpenClaw, plus a critical RCE in Horilla. Multiple issues let lower-trust users reach owner-only tools, bypass approvals, or execute host commands; several also expose secrets, persistent jobs, and browser/session access.

· 18 min read

Executive Summary

Today’s alert is dominated by high-risk authorization bypasses, command execution flaws, and DNS pinning failures in OpenClaw, plus a critical RCE in Horilla. Multiple issues let lower-trust users reach owner-only tools, bypass approvals, or execute host commands; several also expose secrets, persistent jobs, and browser/session access. Patch immediately, especially if you run OpenClaw in identity-aware deployments, use Codex/Slack/Matrix/Signal integrations, or expose Horilla to authenticated users.

Priority now: upgrade affected OpenClaw components to the fixed releases, remove or restrict risky tool surfaces, and assume exposed credentials or approval flows may have been abused until logs are reviewed.

Critical Vulnerabilities

  • CVE-2026-100552: OpenClaw per-chat tool policy bypass
    • Impact: Lower-trust users can still reach shell, process, file, and patch tools through the Codex runtime, enabling host command and file access.
    • Affected Systems: OpenClaw npm package openclaw before 2026.8.1.
    • Immediate Action: Upgrade now and review any Codex runtime assignments tied to restricted conversations.
    • Mitigation: Patch to 2026.8.1; temporarily disable or isolate Codex runtime tool access for untrusted chats.
  • CVE-2026-96795: Horilla export_data code injection
    • Impact: Authenticated users can execute arbitrary OS commands via crafted column input; in shipped Docker deployments this may run as root.
    • Affected Systems: Horilla before 2.0.0.
    • Immediate Action: Upgrade immediately and restrict access to export features until patched.
    • Mitigation: Patch to 2.0.0; treat any exposed Horilla instance as high risk until confirmed fixed.
  • CVE-2026-100586: OpenClaw Codex owner check bypass
    • Impact: Non-owners can create native conversation bindings and execute host-capable turns with file, tool, and process access.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Upgrade and audit any non-owner channel senders with command access.
    • Mitigation: Patch to 2026.7.1; limit channel command access until fixed.
  • CVE-2026-100575: OpenClaw Slack sender allowlist bypass
    • Impact: Disallowed participants in multi-person DMs can trigger agents and access granted tools/data.
    • Affected Systems: OpenClaw Slack before 2026.8.1.
    • Immediate Action: Patch and review DM-based agent exposure.
    • Mitigation: Upgrade to 2026.8.1; tighten sender allowlists and disable sensitive tools in multi-person DMs.
  • CVE-2026-100580: OpenClaw cron tool case-sensitivity flaw
    • Impact: Attackers can create persistent cron jobs that execute attacker-selected commands with OpenClaw process privileges.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Patch and inspect any model-created cron jobs for unexpected payload kinds.
    • Mitigation: Upgrade to 2026.7.1; restrict cron creation to trusted operators only.
  • CVE-2026-100587: OpenClaw Codex installation command authorization bypass
    • Impact: Non-owners can install arbitrary plugins and run MCP processes with user privileges.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Patch now and review installed plugins.
    • Mitigation: Upgrade to 2026.7.1; restrict installation commands to owners.
  • CVE-2026-100551: OpenClaw iOS TLS pinning bypass in Control UI
    • Impact: A redirected control page can steal Gateway tokens or passwords from WebViews.
    • Affected Systems: OpenClaw for iOS 2026.7.1 through 2026.8.10.
    • Immediate Action: Update iOS clients immediately and re-check any accepted Gateway fingerprints.
    • Mitigation: Patch to 2026.8.11; avoid opening Terminal or Dashboard in untrusted network conditions.
  • CVE-2026-100588: OpenClaw browser control scope bypass
    • Impact: Write-scoped callers can inspect and control browser sessions without admin scope.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Patch and review connected browser-capable nodes.
    • Mitigation: Upgrade to 2026.7.1; restrict browser control exposure on shared nodes.
  • CVE-2026-100568: OpenClaw operator cron job access flaw
    • Impact: Model-visible callers can read and force-run ownerless command jobs, exposing secrets and scheduled commands.
    • Affected Systems: OpenClaw before 2026.8.1.
    • Immediate Action: Patch and audit stored environment variables in cron jobs.
    • Mitigation: Upgrade to 2026.8.1; remove sensitive data from ownerless jobs.
  • CVE-2026-100557: OpenClaw skill tool dispatch authorization bypass
    • Impact: Non-owners can reach owner-only tools and server credentials.
    • Affected Systems: OpenClaw before 2026.8.1.
    • Immediate Action: Patch and verify owner-only tool boundaries.
    • Mitigation: Upgrade to 2026.8.1; disable owner-only skills for non-owner senders.
  • CVE-2026-100567: OpenClaw remote CDP DNS rebinding / SSRF
    • Impact: Attackers can force connections to loopback, private, or metadata services through DNS rebinding.
    • Affected Systems: OpenClaw 2026.4.5 through 2026.8.0.
    • Immediate Action: Patch and disable hostname-based remote CDP endpoints if possible.
    • Mitigation: Upgrade to 2026.8.1; use stable, trusted infrastructure only.
  • CVE-2026-100532: OpenClaw WhatsApp login tool boundary bypass
    • Impact: Non-owners can trigger forced login, disrupt the WhatsApp account, and obtain a new QR code.
    • Affected Systems: @openclaw/whatsapp before 2026.8.1.
    • Immediate Action: Patch and monitor for unexpected relogin prompts.
    • Mitigation: Upgrade to 2026.8.1; restrict login tooling to owners only.
  • CVE-2026-100559: OpenClaw escaped-newline command parser bypass
    • Impact: Hidden commands can slip past allowlist parsing and execute without expected prompts.
    • Affected Systems: OpenClaw before 2026.8.1.
    • Immediate Action: Patch and review command allowlists for parser edge cases.
    • Mitigation: Upgrade to 2026.8.1; treat multiline command input as untrusted.
  • CVE-2026-100561: OpenClaw exec approval wrapper trust flaw
    • Impact: Previously approved wrappers can later execute arbitrary inner commands with host privileges.
    • Affected Systems: OpenClaw 2026.3.22 through 2026.8.0.
    • Immediate Action: Revoke or re-evaluate approvals for wrapper-based commands.
    • Mitigation: Upgrade to 2026.8.1; avoid permanent approval for wrapper invocations.
  • CVE-2026-100585: OpenClaw Claude Code permission prompt bypass
    • Impact: Non-owners can approve or deny owner-directed permission prompts, letting actions proceed without owner consent.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Patch and review pending approval flows.
    • Mitigation: Upgrade to 2026.7.1; isolate MCP channel bridge permissions.
  • CVE-2026-100570: OpenClaw Gmail setup environment injection
    • Impact: Untrusted workspace .env content can trigger code execution through CLOUDSDK_PYTHON_ARGS.
    • Affected Systems: OpenClaw 2026.3.28 through 2026.8.0.
    • Immediate Action: Run Gmail setup only from trusted workspaces and clear inherited CLOUDSDK_* variables.
    • Mitigation: Upgrade to 2026.8.1; block attacker-controlled workspace content.
  • CVE-2026-100597: OpenClaw local mirror TOCTOU filesystem mutation
    • Impact: Sandboxed remove/mkdir/rename operations can hit unintended host paths.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Patch and inspect recent filesystem changes in mirrored workspaces.
    • Mitigation: Upgrade to 2026.7.1; limit concurrent path mutations.
  • CVE-2026-100579: OpenClaw requester identity spoofing in message.action
    • Impact: Attackers can impersonate another sender and reach actions denied to the real caller.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Patch and restrict sensitive channel actions to administrators.
    • Mitigation: Upgrade to 2026.7.1; disable identity-dependent actions where possible.
  • CVE-2026-100578: OpenClaw owner-only tool exposure through chat.send
    • Impact: Non-owners can trigger gateway and cron operations, including persistent state changes.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Patch and remove gateway and cron from affected tool policies.
    • Mitigation: Upgrade to 2026.7.1; restrict chat.send to administrators in identity-aware deployments.
  • CVE-2026-100543: OpenClaw redacted config hash leakage
    • Impact: Deterministic hashes can help attackers test low-entropy Gateway passwords offline.
    • Affected Systems: OpenClaw before 2026.8.1.
    • Immediate Action: Rotate weak Gateway passwords and stop exposing redacted config responses.
    • Mitigation: Upgrade to 2026.8.1; use strong secrets and review config access logs.
  • CVE-2026-100541: OpenClaw Matrix identity collision
    • Impact: Different Matrix accounts can normalize to the same OpenClaw identity and inherit privileges.
    • Affected Systems: @openclaw/matrix 2026.2.2 through 2026.8.0.
    • Immediate Action: Patch and review Matrix account mappings immediately.
    • Mitigation: Upgrade to 2026.8.1; audit allowlists, owner commands, and approvals.
  • CVE-2026-100558: OpenClaw listener socket exhaustion
    • Impact: Unauthenticated attackers can exhaust listener resources and cause denial of service.
    • Affected Systems: OpenClaw before 2026.8.1.
    • Immediate Action: Patch and rate-limit malformed WebSocket upgrade traffic.
    • Mitigation: Upgrade to 2026.8.1; add edge filtering and connection limits.
  • CVE-2026-100560: OpenClaw path-only approval reuse on macOS/Linux
    • Impact: Commands approved once can be reused with different arguments without a new prompt.
    • Affected Systems: OpenClaw before 2026.8.1.
    • Immediate Action: Revoke broad allow-always approvals and re-check high-risk executables.
    • Mitigation: Upgrade to 2026.8.1; avoid path-only approvals for sensitive commands.
  • CVE-2026-100535: OpenClaw session memory provenance loss
    • Impact: Restricted user instructions can be replayed to a broader unattended agent, expanding reach beyond the original turn.
    • Affected Systems: OpenClaw 2026.4.5 through 2026.8.0 when session memory and dreaming are enabled.
    • Immediate Action: Disable dreaming or session-memory capture for untrusted conversations.
    • Mitigation: Upgrade to 2026.8.1; review persisted session instructions.
  • CVE-2026-100555: OpenClaw Synology Chat attachment SSRF
    • Impact: DNS rebinding can make the NAS fetch private or policy-denied resources and return their contents.
    • Affected Systems: OpenClaw 2026.7.1 through 2026.8.0.
    • Immediate Action: Patch and disable remote URL attachment forwarding if possible.
    • Mitigation: Upgrade to 2026.8.1; constrain NAS egress and resolver behavior.
  • CVE-2026-100598: OpenClaw Signal approval reaction mix-up
    • Impact: Reactions on unrelated messages may approve or deny a pending host action.
    • Affected Systems: OpenClaw before 2026.7.1.
    • Immediate Action: Patch and separate approval threads from normal chat traffic.
    • Mitigation: Upgrade to 2026.7.1; monitor approval events for mismatched message IDs.

Previously Alerted

What to Do Now

  1. Patch first: upgrade OpenClaw components to 2026.8.1 or 2026.7.1 as applicable, and Horilla to 2.0.0.
  2. Lock down tools: remove owner-only tools from non-owner paths, disable risky integrations, and re-check all approval rules.
  3. Rotate secrets: change Gateway passwords, review exposed tokens, and invalidate any suspicious approvals or QR-based relinks.
  4. Reduce exposure: disable remote CDP endpoints, remote URL attachment forwarding, session dreaming, and broad chat/send permissions where possible.
  5. Verify: inspect logs for unexpected cron jobs, plugin installs, browser actions, permission prompts, and config reads.
  6. Monitor: alert on DNS anomalies, malformed WebSocket upgrades, repeated approval events, and identity collisions across Matrix/Signal/Slack flows.

Verification steps: confirm package versions in deployed images and lockfiles, check iOS client versions, and validate that patched releases are actually running in production. Review any recent ownerless jobs, unexpected plugin changes, and any redacted-config access patterns that could indicate offline secret testing.

Monitoring recommendations: watch for spikes in agent-triggered tool use, permission prompt churn, WebSocket upgrade abuse, DNS rebinding indicators, and unauthorized access to browser, cron, or Gateway controls.

Related Resources

  • Internal: add internal blog post links here once published for OpenClaw authorization hardening and Horilla emergency patch guidance.
  • Official vendor advisories: OpenClaw release notes for 2026.7.1 and 2026.8.1, Horilla security advisory for 2.0.0, and platform-specific notices for iOS, Matrix, Slack, Signal, WhatsApp, and Synology integrations.

Keep reading