CVE-2026-100528

Published: Set 26, 2026 Last Modified: Set 26, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,9
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,4
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: low

Description

AI Translation Available

OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains that provider's credential while the OpenAI SDK selects its own default endpoint. A resulting request could disclose the configured third-party provider credential to an unrelated provider endpoint and fail with a misleading authentication error. Operators who observed this condition should rotate the affected credential. The issue is fixed in 2026.8.1.

200

Exposure of Sensitive Information to an Unauthorized Actor

Draft
Common Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
Technologies: Not Technology-Specific, Web Based, Mobile
View CWE Details
https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-credential-disclo…