CVE-2026-100528 | CVSS: 5.4 | 严重级别: MEDIUM
OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains that provider's credential while the OpenAI SDK selects its own default endpoint. A resulting request could disclose the configured third-party provider credential to an unrelated provider endpoint and fail with a misleading authentication error. Operators who obse
参考链接:
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9
• https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-credential-disclos
📌 数据来源: NVD 官方