OpenClaw CVE-2026-100545

Requires that session-memory filename generation be enabled for an agent that is reachable by lower-trust senders (a non-default, feature-gated deployment). The attacker must be an already-admitted sender (PR:L) whose policy has removed certain tools, and exploitation only succeeds if the language model acts on the injected instruction and the embedded helper actually exposes the targeted tools (AT:P, AC:H). Limiting factors: no anonymous access, model non-determinism, dependence on which tools the helper retains, and the availability of the vendor workaround (disable session-memory filename generation for agents reachable by lower-trust senders). Fixed in 2026.8.1.

All available signals point to a genuine but low-priority issue. The vendor CVSS 4.0 vector (6.0, AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N) describes a network-reachable but high-complexity flaw requiring an attack precondition (AT:P) and low-level privileges (PR:L) - i.e. a sender already admitted to a channel that reaches the agent, not an anonymous internet attacker. There is no EPSS score, no CISA KEV listing, and no public exploit code, so this is 'no public exploit identified at time of analysis.' The AC:H/AT:P metrics are well-justified: the description explicitly states exploitability depends on the model acting on the injected instruction and on which tools the helper happens to expose, both of which are non-deterministic and outside attacker control. Impact is integrity-only (VI:H via creation of persistent scheduled work); confidentiality and availability are rated N by the vendor and I agree. This is a real authorization-boundary defect (CWE-863) worth patching, but it is a config-gated, model-mediated, authenticated-sender issue in a niche framework - not a widespread-exploitation priority. Note the CWE (863, authorization) conflicts with the 'Authentication Bypass' tag, which is a mislabel: no authentication is bypassed, an effective tool policy is.

A lower-trust sender who can reach an agent that has session-memory filename generation enabled crafts a message whose model-mediated instructions steer the embedded filename-generation helper into invoking tools that the sender's own policy had removed. Because the helper retained those tools, the model can be induced to create persistent scheduled work (e.g. a recurring/cron-like job) on the agent's behalf. No public proof-of-concept exists; success is contingent on the model following the injected instruction and on which tools the helper exposes.