OpenClaw CVE-2026-100598

Exploitation requires all of the following in a single Signal conversation managed by OpenClaw before 2026.7.1: a pending structured approval request, one or more unrelated outbound text messages present simultaneously, and precise timing so the approver's reaction lands ambiguously (AC:H/AT:P). A legitimate approver must actually issue a reaction (UI:P), and the actor must already be a participant/approver in the conversation (PR:L) - not an unauthenticated outsider. The realized impact is further limited to whatever host actions the OpenClaw process is authorized to perform for the pending request; the flaw does not grant new authority to any party.

This is a logic/origin-validation flaw (CWE-346) in how OpenClaw binds Signal approval reactions to structured approval requests. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H) yields 7.5 (HIGH), but several metrics temper real-world risk: AC:H plus AT:P means exploitation requires a specific race condition - a pending approval and unrelated outbound messages must coexist in the same conversation with the right timing - and UI:P means a legitimate approver must actually react. PR:L confirms the actor is an already-trusted conversation participant, not an anonymous internet attacker. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing, no EPSS score in the input, and the advisory (GHSA-r88x-r7jj-f2cf) provides no POC. The high VC/VI/VA scores are conditional: the description explicitly states 'the practical impact depends on the pending request, conversation timing, and the actions available to the OpenClaw process,' so worst-case host-action approval justifies high impact only where the process can perform sensitive host actions. Notably the flaw does NOT change approver authority - it is a misbinding, not privilege escalation. Net: a genuine authorization-integrity concern for OpenClaw operators, but the high AC/AT/UI gating and niche footprint make it a moderate rather than urgent priority. The 'Information Disclosure' tag mischaracterizes the issue, which is fundamentally an authorization/integrity flaw.

In a Signal conversation where OpenClaw is awaiting an approver's reaction to a structured host-action approval request, unrelated outbound text messages are also present. The approver reacts to one of the ordinary text messages, and due to the misbinding logic the reaction is instead attributed to the pending approval, causing a host action to be approved (or denied) without the approver's intent. No public exploit code is identified, and reliable exploitation depends on precise conversation timing (AC:H/AT:P).