CVE-2026-100540: Openclaw Feishu

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked identity.

Affected products

• Openclaw Feishu: before 2026.8.1 (fixed in 2026.8.1)

Published 2026-09-26. Last modified 2026-10-08.