OpenClaw CVE-2026-100539

Requires that OpenClaw memory features be in use and that an operator hot-disables the memory configuration WHILE a previously created memory_search/memory_get tool instance remains active within an already-running agent turn. The stale access only persists for the remainder of that single run, and it is read-only over durable memory (no writes, no availability impact). Limiting factors: high attack complexity, a specific mid-turn disablement timing window, low-privilege access already present, and passive user interaction - the flaw cannot be triggered against a fresh turn or after the run ends. This is not remotely exploitable against a default configuration by an unauthenticated attacker.

This is a genuinely low-priority issue despite being network-reachable on paper. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N) scores just 2.1, and all signals agree it is minor: no EPSS score published, not on CISA KEV, and no public exploit identified. The high attack complexity (AC:H), attack requirement (AT:P), low-privilege requirement (PR:L) and passive user interaction (UI:P) reflect that this is not attacker-initiated in the traditional sense - it is a race-like revocation gap that only manifests during an already-running agent turn where a memory tool instance was created before the operator hot-disabled memory. Confidentiality impact is Low and integrity/availability are None, since the flaw only lets the model continue read-only access to durable memory for the remainder of the current run. There is no conflict between the description and CVSS: both point to a transient, low-impact authorization-enforcement lapse, not a widely weaponizable vulnerability. Real-world priority is low; patch on normal cadence.

An operator hot-disables memory configuration while an agent turn is already in progress and a memory_search/memory_get tool instance was created before that change. Because the execution-time resolver restores the stale enabled configuration, the model keeps reading durable memory for the rest of that run despite the operator having revoked access. No public exploit code exists, and exploitation is opportunistic rather than attacker-driven, requiring the precise timing of disablement mid-turn.