Is CVE-2026-100584 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100584 being exploited in the wild.

How severe is CVE-2026-100584?

Medium severity, with a CVSS score of 6.7, published 26 September 2026.

Which products and versions are affected?

Openclaw >= 2026.2.26, < 2026.7.1.

Is there a fix for CVE-2026-100584?

A patch was published on 2026-09-11: Version 2026.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100584 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-100584?

Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100584: OpenClaw arbitrary code execution via PATH search allowlist bypass

Q: Is there a fix for CVE-2026-100584?

A patch was published on 2026-09-11: Version 2026.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-100584 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-100584?

Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100584 · Severity: medium · CVSS 6.7 · Published 2026-09-26

OpenClaw is an npm-distributed agent runtime that executes tasks on Windows and other systems. In affected versions, an attacker who can place files in a workspace directory can trick the agent into executing a malicious executable with the same name as an allowlisted program, bypassing the execution safeguards. This allows arbitrary code execution with the privileges of the agent's user account, potentially compromising data or enabling lateral movement in a network.

Technologies: Openclaw. Vendors: Openclaw.

Quick answers

Is CVE-2026-100584 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100584 being exploited in the wild.
How severe is CVE-2026-100584?: Medium severity, with a CVSS score of 6.7, published 26 September 2026.
Which products and versions are affected?: Openclaw >= 2026.2.26, < 2026.7.1.
Is there a fix for CVE-2026-100584?: A patch was published on 2026-09-11: Version 2026.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100584 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-100584?: Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A PATH search order vulnerability in PowerShell command analysis (CWE-426) allows an attacker to shadow an allowlisted executable by placing a same-named file in an agent-writable workspace directory. The agent approves an executable from PATH but later executes the workspace copy when a bare executable name is used in an approved PowerShell command, requiring low privileges, high attack complexity, and user interaction. The fix is available in version 2026.7.1.

Affected products

OpenClaw OpenClaw >= 2026.2.26, < 2026.7.1

Timeline

2026-09-26: disclosed
2026-09-11: patched: Version 2026.7.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.