Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as offline password verifiers: a caller able to obtain the redacted configuration (for example via config.get) could test password candidates offline without going through the rate-limited Gateway authentication path. Recovering the password could grant the documented shared-secret operator authority. Secret references were not affected in the same way. The issue is fixed in 2026.8.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 HIGH Severity: CVE-2026-100543 (CVSS 7.5) OpenClaw npm package <2026.8.1 exposes deterministic hashes enabling offline password attacks against Gateway credentials. Low-entropy passwords at risk. Patch to 2026.8.1 immediately. #CVE #Vulnerability #PatchNow https://t.co/QFpTzJ4jsh