Is CVE-2026-100588 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100588 being exploited in the wild.

How severe is CVE-2026-100588?

High severity, with a CVSS score of 8.3, published 26 September 2026.

Is there a fix for CVE-2026-100588?

A patch was published on 2026-07-01: version 2026.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100588 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100588?

Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100588: OpenClaw authorization bypass in node.invoke browser control

CVE-2026-100588 · Severity: high · CVSS 8.3 · Published 2026-09-26

OpenClaw is a Node.js package that provides programmatic access to browser control and other operations through Gateway deployments. A flaw in versions before 2026.7.1 allows write-scoped users to bypass administrator requirements and control connected browsers—inspecting pages, navigating tabs, or interacting with web applications without proper authorization. This could expose sensitive data visible in the browser or enable unauthorized actions on web applications the browser is logged into.

Technologies: Openclaw. Vendors: Openclaw.

Quick answers

Is CVE-2026-100588 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100588 being exploited in the wild.
How severe is CVE-2026-100588?: High severity, with a CVSS score of 8.3, published 26 September 2026.
Which products and versions are affected?: Openclaw before 2026.7.1.
Is there a fix for CVE-2026-100588?: A patch was published on 2026-07-01: version 2026.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100588 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100588?: Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization check (CWE-863) where the node.invoke method fails to enforce administrator scope requirements for browser control operations, even though direct browser.request access properly requires admin scope. A write-scoped caller with network access to the OpenClaw Gateway and a connected browser-capable node can reach browser functionality without the configured admin privilege requirement. The fix is available in version 2026.7.1.

Affected products

OpenClaw openclaw before 2026.7.1

Timeline

2026-09-26: disclosed
2026-07-01: patched: version 2026.7.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.