OpenClaw CVE-2026-100596

Requires an authenticated but non-owner user account on a shared/multi-user OpenClaw instance (PR:L); the attacker abuses the '/mcp set' and '/mcp unset' commands, which fail to check that the caller owns the configuration, to write a persistent stdio MCP server entry. Execution of the injected command occurs when OpenClaw next loads its MCP configuration, so payload execution is deferred to a config-load event. Limiting factors: exploitation is not available to fully unauthenticated attackers, is only meaningful in deployments where more than one principal shares an OpenClaw instance/configuration, and applies only to versions before 2026.7.1.

This is a genuine high-priority issue rather than a high-CVSS-but-low-risk paper flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H = 8.7) describes a network-reachable, low-complexity missing-authorization flaw (CWE-862) that any low-privileged/non-owner authenticated user can trigger with no user interaction, yielding full confidentiality, integrity, and availability impact on the host. The impact is effectively arbitrary command execution: an attacker persists a malicious stdio MCP command that runs with OpenClaw process privileges when configuration loads. My independent CVSS 3.1 assessment (~8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) agrees closely with the vendor. Countervailing signals: no EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or automated exploitation yet, and PR:L means an attacker must first have some authenticated foothold (a non-owner account) - this is a privilege-escalation/lateral-movement primitive, not an unauthenticated internet-wide RCE. Net: real and worth patching promptly for anyone running OpenClaw multi-user, but exploitation is gated on prior authenticated access and the product footprint is small.

A low-privileged, non-owner user of a shared OpenClaw instance issues '/mcp set' to register a malicious stdio MCP server command (e.g., a reverse shell or data-exfil script). Because authorization is not enforced on this command, the entry persists and executes with OpenClaw's process privileges the next time configuration loads, giving the attacker code execution on the host. No public proof-of-concept was identified at time of analysis.