← Back to the live CVE advisory feed

CVE-2026-100599: Product identification pending

Severity

8.7 (HIGH)

Vendor

OPENCLAW

Affected versions

Through 2026.7.0

Fixed version

2026.7.1

Patch status

Patched

Published

2026-09-26T03:17:08.667

Modified

2026-09-26T03:17:08.667

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.

Technical summary

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In deployments with the Google Meet plugin enabled, a paired Chrome node, and the googlemeet.chrome node command allowed, a tool-enabled agent able to invoke that command can execute attacker-selected processes on the paired node, impacting files, credentials, browser profiles, and availability on that node. The issue is fixed in 2026.7.1; as a workaround, remove googlemeet.chrome from allowed node commands or disable the Google Meet plugin.

View the official NVD record for CVE-2026-100599

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.