OpenClaw Codex CVE-2026-100586

Exploitation requires that the attacker already be a non-owner sender within an OpenClaw channel AND hold 'command access' on that channel; with that access they can create a native conversation binding to the Codex runtime that the owner-authorization enforcement should have denied. The limiting factor is this pre-existing command-access grant - a fully external, access-less attacker cannot trigger the flaw - but no additional user interaction, non-default configuration, or owner action is needed beyond that. Affected deployments are OpenClaw Codex versions before 2026.7.1.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 (High) and describes a network-reachable, low-complexity authorization-bypass privilege escalation requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact on the vulnerable system. This is a genuine concern rather than an inflated score: the flaw converts a low-privilege 'channel sender with command access' into a host-capable actor with access to files, tools, and processes - effectively remote code execution against the host. However, three key exploitation signals are absent from the input: no EPSS probability, no CISA KEV listing, and no public exploit code, so exploitation likelihood cannot be quantified - no public exploit identified at time of analysis. The offsetting factor tempering real-world risk is prevalence: OpenClaw is a niche open-source agent/sandbox tool, so despite the high technical severity the exposed population is small. Net: technically serious (authz bypass to host RCE) but the precondition of already holding command access on a channel and the limited deployment footprint keep this at medium operational priority rather than emergency.

An attacker who is a non-owner participant in an OpenClaw channel but has been granted command access issues a request that creates a native conversation binding to the Codex runtime, a binding the owner-authorization check should have blocked. Having bound to the native runtime, the attacker executes host-capable turns that read/write files, invoke tools, and spawn processes on the host running OpenClaw. No public proof-of-concept is referenced, and the low attack complexity plus no-user-interaction requirement make the operation reliable once command access is held.