OpenClaw CVE-2026-100591

Requires an already-authorized non-owner sender operating over an external channel bridged to the OpenClaw Gateway, plus command policy that admits that sender to issue mutations. Exploitation is limited strictly to the persistent global Active Memory on/off toggle; session-level controls and read-only status remain governed by existing command policy and are not affected. Owner privileges are NOT required (that is the bug), but baseline authorized command access to the Gateway is, and no additional user interaction is needed. Only versions before 2026.7.1 are vulnerable.

This is a genuine but low-severity authorization flaw (CWE-862, missing owner check), not a high-CVSS-but-inflated issue - the vendor CVSS 4.0 of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) is medium and honestly reflects limited impact. The vector shows network reach and low complexity, but exploitation requires PR:L (an already-authorized non-owner sender), which caps the blast radius. Impact is confined to persistently toggling the global Active Memory on/off state - degrading memory recall or re-enabling it against the owner's intent - with no confidentiality/integrity of arbitrary data and no code execution. There is no EPSS score, no CISA KEV listing, and no public PoC provided, so this is no public exploit identified at time of analysis. The 'Authentication Bypass' tag overstates the nature of the issue: this is an authorization (missing owner check) defect on a configuration toggle, not an auth bypass. Net: low real-world priority, patch on normal cadence.

An OpenClaw Gateway is bridged to an external chat channel where a non-owner user has been granted command access. That authorized-but-non-owner sender issues the global Active Memory toggle mutation, which fails to enforce the owner-only check, letting them persistently disable memory recall for all future sessions (or re-enable global recall the owner wanted off). No public exploit code is identified at time of analysis.