EUVD-2026-87525
GHSA-49qj-frf3-688h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain sub-read authenticated identity via trusted-proxy
-
DeliveryRequest Prometheus metrics endpoint
-
ExploitMissing operator.read scope check
-
ExecutionRetrieve diagnostics document
-
ImpactDisclose operational metrics
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Gateway to run in an identity-bearing authentication mode (the description names trusted-proxy) AND the attacker to already possess a valid authenticated profile whose effective role lacks the operator.read scope. Exploitation is limited to reaching the @openclaw/diagnostics-prometheus metrics endpoint in versions before 2026.9.3. It does NOT apply to shared-secret Gateway callers (they already hold full operator scope) and does not work against default deployments that either disable the Prometheus endpoint or restrict endpoint reachability to operator.read holders (the documented workarounds). No user interaction is required. |
| Impact | This is a genuinely low-priority issue despite the CRITICAL-sounding 'Authentication Bypass' tag. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and is internally consistent with the description: it is a missing-authorization flaw (CWE-862) that requires an already-authenticated caller (PR:L) and discloses only low-sensitivity operational Prometheus metrics (VC:L) with no integrity or availability impact. My independent assessment agrees the impact is confidentiality-only and low. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. The one signal to weigh honestly is the narrow precondition: exploitation only applies in identity-bearing Gateway auth modes such as trusted-proxy - shared-secret callers already legitimately hold full operator scope and are explicitly unaffected. Net: a real but minor information-disclosure/authorization gap, not a widespread-exploitation priority. Note the 'Authentication Bypass' tag is misleading - this is an authorization (scope-enforcement) failure against an already-authenticated identity, not an authentication bypass. |
| Exploit ScenarioDerived | In a deployment using trusted-proxy (identity-bearing) Gateway authentication, an attacker holds a valid but intentionally low-privilege profile that lacks the operator.read scope. They send an authenticated request directly to the @openclaw/diagnostics-prometheus metrics endpoint and receive the full diagnostics document even though ordinary read methods reject that same identity. No public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
An authenticated caller whose effective role deliberately lacks the operator.read scope can still retrieve the full Prometheus diagnostics document from the @openclaw/diagnostics-prometheus plugin in OpenClaw versions before 2026.9.3, because the plugin's authenticated metrics endpoint does not enforce the scope that ordinary read methods do. The result is limited information disclosure of operational metrics to a profile that was intentionally restricted below read access - confidentiality impact only, with no integrity or availability effect. Exploitation requires the Gateway to run in an identity-bearing authentication mode (for example trusted-proxy) and the attacker to already hold a valid authenticated profile, so shared-secret Gateway callers and default deployments that disable or restrict the endpoint are unaffected; no public exploit code was identified at time of analysis and the issue is fixed in 2026.9.3.
RemediationAI
Vendor-released patch: upgrade @openclaw/diagnostics-prometheus to 2026.9.3, which enforces operator.read on the metrics endpoint; consult the GitHub advisory GHSA-rx8p-qcpv-c7vr and the VulnCheck advisory for the official guidance. Where upgrading is not immediately possible, apply one of the documented workarounds: disable the Prometheus endpoint entirely, which removes the exposed attack surface at the cost of losing Prometheus-based metrics collection and observability for that deployment, or keep the endpoint enabled but ensure every identity that can reach it is intended to hold operator.read (for example by tightening trusted-proxy identity mappings, network ACLs, or reverse-proxy rules that gate the metrics path), which preserves metrics scraping while requiring ongoing review of any role whose access falls below operator.read. Because only confidentiality of operational metrics is at stake and exploitation requires a pre-existing authenticated low-privilege profile under a non-default identity-bearing auth mode, remediation can be scheduled rather than treated as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a missing authorization check (CWE-862) in the OpenClaw Prometheus diagnostics plugin, tracked by CPE cpe:2.3:a:openclaw:diagnostics-prometheus:*:*:*:*:*:*:*:* and by ENISA EUVD-2026-87525. OpenClaw's Gateway supports multiple authentication modes, including identity-bearing modes such as trusted-proxy that map an inbound identity to an effective operator role and its scopes. Ordinary read methods correctly reject an identity whose role lacks the operator.read scope, but the diagnostics metrics endpoint - the surface that emits the Prometheus-scrapeable diagnostics document - was written without the corresponding scope enforcement, creating an authorization inconsistency rather than a break in the authentication layer itself. Because shared-secret Gateway authentication already grants the documented full operator scope, that path is not affected; the flaw only manifests when an identity is deliberately assigned a role below operator.read and is still able to reach the metrics endpoint.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint (AV:N/AC:L) but requires an existing authenticated low-scope identity (PR:L); only low-sensitivity operational metrics are disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective role has no read scope can retrieve the diagnostics document even though ordinary read methods reject the same identity, disclosing operational metrics to an authenticated profile intentionally limited below read access. Shared-secret Gateway callers already hold the documented full operator scope and are not affected. The issue is fixed in 2026.9.3; as a workaround, disable the Prometheus endpoint or ensure every identity that can reach it is intended to hold operator.read.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB