OpenClaw CVE-2026-100592

Requires the OpenClaw Gateway to expose the persistent '/dreaming on' and '/dreaming off' commands to external channels, and the attacker must already be an authorized (policy-admitted) but non-owner sender on such a channel - matching PR:L in the vector. Exploitation is limited by these prerequisites: the attacker needs standing authorized channel access, and the operator can fully mitigate by applying the documented workaround (disable dreaming commands in external channels, or restrict channel command access to owners). Read-only status and help commands are unaffected as they remain governed by normal command policy.

This is a genuinely low-severity authorization flaw, and the signals are consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, score 5.3) describes network reach with low attacker privileges and no user interaction, but with uniformly LOW confidentiality, integrity, and availability impact - the flaw only lets a non-owner toggle a memory-processing behavior, not read/write data or execute code directly. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The CWE-862 (Missing Authorization) classification matches the description precisely: an owner-only command boundary is not enforced for '/dreaming on|off'. The realistic priority is LOW: it is a missing-check bug in a niche open-source Node.js agent framework whose worst outcome is unexpected enabling/disabling of background memory promotion, with actual C/I/A consequences that depend entirely on what conversation material is stored and how memory is later used. Note that the input Tag 'Authentication Bypass' overstates the issue - this is an authorization (permission-check) gap for an already-authorized sender, not an authentication bypass.

An external-channel user who is already authorized to interact with the OpenClaw Gateway (but is not the owner) sends the persistent '/dreaming off' command, silently disabling the Memory Core's background memory processing that the owner expected to remain running - or conversely '/dreaming on' to re-enable durable memory promotion the owner had turned off. No exploit code is publicly available, and the low attack complexity means the 'attack' is simply issuing a chat command over the channel.