CVE-2026-100528: OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In
Summary
OpenClaw (an npm package) before version 2026.8.1 had a bug where credentials (authentication information) for third-party API providers could be accidentally sent to the wrong endpoint (server address) if the model metadata didn't include a specific base URL and the session was still active after a configuration update. This could leak sensitive credentials to an unrelated provider and cause authentication failures. The issue is fixed in version 2026.8.1.
Solution / Mitigation
Update OpenClaw to version 2026.8.1 or later. Additionally, the source states that "operators who observed this condition should rotate the affected credential" (generate new authentication credentials to replace the ones that may have been exposed).
Vulnerability Details
5.4(medium)
EPSS: 0.2%
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L
network
high
low
required
September 25, 2026
Classification
Affected Vendors
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-100528
First tracked: September 26, 2026 at 02:07 AM
Classified by LLM (prompt v3) · confidence: 92%