OpenClaw publishes 87 flaws in its AI agent gateway

What happened

OpenClaw, the open-source gateway that connects chat apps to coding agents such as Codex and Claude Code, had 87 CVE records published between 26 and 30 September 2026: 79 on the 26th, two on the 29th and six on the 30th. On CVSS 3.1, 33 are High, 49 Medium and 5 Low, and ten share the top score of 8.8. The common thread is non-owner chat participants reaching owner-only actions: binding the native Codex runtime, installing plugins through the Codex computer-use command, persisting stdio MCP commands through /mcp set, or getting round exec approval on Windows and Google Meet nodes.

81 of the 87 records give an affected range that ends at a released version, 47 of them fixed in 2026.8.1 and 24 in 2026.7.1, which shipped on 13 July, weeks before the records; five cover the hosted ClawHub registry. CVE-2026-101883, an SSRF in the Windows Node's canvas.present capability, lists every release through 2026.9.4 as affected, and the latest npm release is 2026.9.7 of 30 September. Row ai-incident-0103 carries one record from this batch, CVE-2026-100585, on its own.