Critical vulnerability in OpenClaw

Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.0, CVEs: CVE-2026-100551, Summary: The iOS Control UI did not enforce saved Gateway TLS pins. In affected versions, authenticated Terminal and session Dashboard WebViews omitted the saved Gateway fingerprint even though native connections enforced it. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators,…

Číst originál na NCSC-FI →

CZ · EN/orig

OpenClaw FI

tg: zranitelnost

CVE v události 1

CVE	hodnocení	KEV	EPSS
CVE-2026-100551	9.0 4.0 · VulnCheck 8.3 3.1 · VulnCheck	–	< 0.01

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.0.