OpenClaw CVE-2026-100537

Requires a deployment that has Active Memory enabled AND configures requester-specific tool rules (toolsBySender) that explicitly deny the target sender the memory tools (memory_search, memory_get). The attacker must be an already-admitted sender (PR:L) reaching the agent, and exploitation depends on the deterministic/hidden automatic-recall path firing for their request (AT:P, AC:H). Exploitation is limited to non-default configurations combining Active Memory with per-sender denials; there is no user interaction requirement, but success is opportunistic and yields only information derived from durable memory, not direct tool invocation or write/availability impact.

All signals point to a genuinely low-priority issue. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N) scores only 2.3, and the metrics are internally consistent with the description: network reachable but high attack complexity (AC:H), a present attack requirement (AT:P), a low but non-zero privilege requirement (PR:L, the sender must already be admitted to the deployment), and confidentiality-only, low-magnitude impact (VC:L, no integrity or availability effect). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'. This is not a high-CVSS-but-hidden-risk case nor the reverse - it is a low-CVSS, low-real-risk broken-authorization flaw whose payoff is limited to leaking information *derived from* durable memory into an agent response, not direct tool access or data exfiltration. One labeling conflict exists: the 'Authentication Bypass' tag is inaccurate - CWE-862 and the description describe a missing authorization (tool-policy enforcement gap during Active Memory recall), not an authentication bypass. Impact is further bounded by what durable memory actually contains in a given deployment.

In a deployment using Active Memory alongside requester-specific toolsBySender rules that explicitly deny a particular sender access to memory_search/memory_get, that admitted-but-denied sender interacts with the agent normally. Automatic recall silently retrieves durable memory and folds it into the agent's context, so the agent's reply may reveal information derived from that memory even though the sender never invoked a memory tool. No public exploit code is identified; the high complexity and required prior configuration make this an opportunistic information leak rather than a reliable attack.