A newly published advisory for CVE-2026-100585 describes a high-severity authorization flaw in OpenClaw versions before 2026.7.1.
Claude Code permission prompts could be delivered through an MCP channel bridge with an owner-only approval requirement. The flaw allowed an authorized non-owner channel sender with channel-command access to approve or deny a pending permission request intended for the owner. The requested action could therefore proceed without the required owner consent.
Approval is not just a button
The approval response could arrive through a legitimate channel from a legitimate participant and still be unauthorized.
That exposes a fundamental distinction: permission to communicate with an approval system is not authority to approve the action.
An approval should be valid only if the approving principal independently possesses authority to approve that exact effect.
Bind approval to authority and effect
A consequential approval should bind the approving principal, authority role, mandate, requesting agent, target, operation, material parameters, constraints, expiry and effect identity.
Channel membership, repository membership, workspace access or the ability to submit an approval response cannot substitute for that authority.
The right question is not simply whether somebody approved the action. It is whether the person who approved it had authority to approve that exact effect.
Sources
NEXT STEP