Is CVE-2026-100596 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-100596?

CVE-2026-100596 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-100596

Description

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host confidentiality, integrity, and availability.