OpenClaw CVE-2026-100587

Exploitation requires that the attacker be a sender in an OpenClaw channel (PR:L - an authenticated but non-owner participant) and that the target instance runs a vulnerable version before 2026.7.1 with the Codex computer-use installation feature reachable. The specific trigger is the Codex computer-use install command, which fails to validate owner authorization, so a non-owner message that would normally be rejected is accepted and executes plugin installation / MCP process spawning with OpenClaw user privileges. Limiting factors: the attacker needs the ability to submit channel messages (some level of access to the OpenClaw deployment), and only versions prior to 2026.7.1 are affected; no user interaction by the owner is needed (UI:N).

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects a genuinely dangerous authorization flaw: any low-privileged channel sender (PR:L) can remotely (AV:N), with no user interaction and low complexity, invoke the Codex computer-use install command to install arbitrary plugins and spawn MCP processes running as the OpenClaw user - full confidentiality, integrity, and availability impact on the host. This is a missing-authorization / privilege-boundary defeat (CWE-862), not a memory-safety or config-edge-case bug, so exploitation is deterministic once a message can reach the channel. However, the exploitation-probability signals temper the raw severity: no EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the provided intelligence, so there is no public exploit identified at time of analysis. SSVC-wise, technical impact is high and the flaw is likely automatable (single crafted command), but exploitation status is 'none' pending any observed activity. Net: a legitimately high-severity, easy-to-exploit authz bug that warrants prompt patching for any exposed instance, but not (yet) evidence of widespread active exploitation - priority is driven by the low bar to exploit and total host compromise, not by exploitation telemetry. The affected product's small footprint keeps aggregate real-world risk moderate rather than critical.

An attacker who is a non-owner participant in an OpenClaw channel sends a crafted Codex computer-use installation command that the server fails to authorize against the owner. The command installs an attacker-chosen plugin and launches an MCP process running with OpenClaw user privileges, giving the attacker code execution and full read/write control over the host. No public exploit code is identified at time of analysis, but the flaw is low-complexity and requires only channel-sender access.