OpenClaw CVE-2026-100528

Requires a specific chain of non-default conditions: (1) a configured third-party provider that uses an OpenAI-compatible API, (2) that provider's resolved model metadata lacking a concrete/explicit base URL, (3) a session pinned to that provider, and (4) a model-configuration hot reload occurring while the session continues. Only then does the pinned session retain the provider credential while the OpenAI SDK falls back to its default endpoint, leaking the key. Limiting factors: operator/authenticated-level access to configure providers (PR:L), the coincidence of a hot reload during an active pinned session (AT:P, AC:H), and the requirement that base URL metadata is absent - a misconfiguration rather than a default state. This is not remotely triggerable against a default configuration.

This is a genuinely lower-priority credential-exposure issue despite its 5.9 CVSS 4.0 score. The vendor vector (AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:L) already signals a hard-to-reach, precondition-heavy bug: high attack complexity (AC:H), an explicit attack requirement (AT:P), authenticated/operator-level access (PR:L), and required interaction (UI:P). The confidentiality impact is rated high (VC:H) only because a live third-party provider API credential can leak, but integrity is none and availability is low (VA:L - the request merely fails with a misleading auth error). No EPSS score, no CISA KEV listing, and no public PoC were provided, so exploitation status is 'no public exploit identified at time of analysis.' Critically, this is not attacker-driven in the usual sense - it triggers from an internal race between a model-config hot reload and a pinned session for a misconfigured OpenAI-compatible provider, not from a crafted external request. The realistic risk is accidental leakage of a credential to an unrelated vendor endpoint rather than active adversarial exploitation. No signals conflict; the high VC:H is the only reason the score is not lower, and it is well-tempered by AC:H+AT:P+UI:P. Overall: low real-world priority, remediated by upgrade and credential rotation.

An operator configures a third-party LLM provider that speaks an OpenAI-compatible API but whose resolved model metadata omits a concrete base URL. While a session is pinned to that provider, the operator hot-reloads the model configuration; the pinned session keeps the third-party credential but the OpenAI SDK falls back to its own default endpoint, so the next request ships the third-party API key to an unrelated provider's endpoint and returns a misleading authentication error. No public exploit code exists; this is primarily an internal misconfiguration/timing condition rather than a remotely weaponizable attack.