CVE-2026-100540
MediumCVSS 6.8Summary
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.
Risk Assessment
Risk of unauthorized access to Feishu resources via a revoked identity, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update OpenClaw Feishu to version 2026.8.1 or later and ensure disabled default accounts do not retain credentials.
Other vulnerabilities in OpenClaw Feishu
See all- CVE-2026-62188High
In the OpenClaw @openclaw/feishu library versions up to and including 2026.6.6, an incorrect authorization vulnerability was found where Feishu permission tools could ignore per-account disablement settings. This allows a lower-trust caller or configured input path to perform actions that should require stronger authorization. The issue is fixed in version 2026.6.9.
- CVE-2026-62187High
A vulnerability in the npm package @openclaw/feishu (versions up to 2026.6.6) allows ignoring per-account disablement. A lower-trust caller or a configured input path can perform actions requiring stronger authorization, leading to unauthorized operations. The issue is fixed in version 2026.6.9.
Original NVD description (English source)
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS