OpenClaw CVE-2026-100594

Requires an authenticated but non-owner account on the OpenClaw instance (PR:L) that can reach the /export-trajectory endpoint over the network; the attacker then requests a session they do not own and the server fails to enforce owner-only authorization, returning the trajectory bundle. Limiting factors: valid credentials/session are needed (not anonymous), the target session must exist and be referenceable by the attacker, and only instances running versions before 2026.7.1 are affected - upgrading to 2026.7.1 remediates. Impact is confined to disclosure of trajectory data; no write or availability effect.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N) is internally consistent and honest: a network-reachable, low-complexity, low-privilege authorization bypass that leaks confidential data only (no integrity or availability impact), scoring 7.1. My independent 3.1 mapping yields ~6.5 (C:H, I/A:N). The PR:L is the key limiter - the attacker must be an authenticated but non-owner sender, so this is a horizontal authorization/BOLA-style flaw among legitimate users rather than a fully anonymous internet-facing leak. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis.' Signals are not conflicting but are thin: severity rests entirely on the confidentiality of exported trajectory bundles (prompts, model messages, tool schemas, runtime events, local path metadata), which can be sensitive (secrets in prompts, filesystem layout for later attacks) but is a disclosure-only issue. Net: a real, patchable authorization bug worth fixing, but a moderate priority - not a high-real-risk emergency given authentication is required, deployment footprint is small, and there is no evidence of exploitation.

An authenticated OpenClaw user who is not the owner of a target session sends a request to the /export-trajectory endpoint referencing another user's session; because ownership is not enforced, the server returns that session's full trajectory bundle. The attacker harvests prompts, model messages, tool schemas, runtime events, and local path metadata - potentially exposing embedded secrets and host filesystem structure. No public POC or active exploitation is identified at time of analysis.