EUVD-2026-87521
GHSA-4gx2-8r4q-vj5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain admitted low-privilege sender access
-
DeliveryIdentify existing allow-always file-transfer grant
-
ExploitCraft glob/display-name to widen scope
-
ExecutionReuse standing approval without re-review
-
ImpactRead or write sibling paths / other nodes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a pre-existing 'allow-always' file-transfer approval that an operator previously granted, plus an already-admitted low-privilege sender (PR:L) who can steer the agent (UI:P). The attacker must abuse glob metacharacter interpretation and/or node display-name reuse so the standing grant resolves to unreviewed sibling paths or a different node. Limiting factors: without a prior allow-always grant there is nothing to widen; success depends on winning path/name interpretation (AC:H/AT:P), so it is not reliably automatable; impact is bounded to file read/write (no availability effect) and to what the agent's file-transfer capability can reach. Fixed in OpenClaw 2026.8.1. |
| Impact | This is a genuine but conditional issue, not a drive-by critical. The vendor CVSS 4.0 vector (7.4, CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P) is internally consistent with the description: AC:H and AT:P reflect the need to win glob/display-name interpretation quirks, PR:L reflects an already-admitted low-privilege sender, and UI:P reflects the operator having previously granted an allow-always file-transfer approval. VC:H/VI:H with VA:N correctly captures a confidentiality+integrity file-access impact with no availability effect. No EPSS score, no CISA KEV listing, and no public PoC were provided, so there is no signal of active or automated exploitation - exploitation status is 'no public exploit identified at time of analysis.' The realistic priority is MEDIUM: it is an authorization scope-widening (privilege/approval-reuse) bug gated behind a prior operator grant plus a steered agent, so it is not mass-exploitable and depends on a specific in-product workflow rather than a default-exposed network surface. Note the input Tag 'Authentication Bypass' conflicts with the actual weakness (CWE-863, authorization scope widening) - treat this as an authorization flaw, not an authentication bypass. |
| Exploit ScenarioDerived | An operator grants an allow-always approval for a file-transfer to a specific path or node. Later, a low-privilege but already-admitted sender steers the agent to reuse that standing grant, supplying glob metacharacters or a reused node display name so the transfer resolves to sibling paths or a different node the operator never reviewed, disclosing or overwriting files beyond the intended scope. No public exploit code is identified, and success requires the pre-existing grant plus favorable path/name interpretation (AC:H/AT:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Authorization scope widening in OpenClaw before 2026.8.1 allows an authenticated low-privilege sender to reuse a standing 'allow-always' file-transfer approval and reach file paths or nodes that the operator never reviewed, resulting in unauthorized file read and write (C:H/I:H, no availability impact) within whatever the agent's file-transfer capability can touch. Exploitation is conditional: it requires a previously granted allow-always approval, an already-admitted sender who can steer the agent (PR:L/UI:P), and successful abuse of glob metacharacter interpretation or node display-name reuse to resolve the grant to sibling paths or a different node (AC:H/AT:P), so it is not reliably automatable and there is no prior grant to widen otherwise. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; a vendor patch is available in OpenClaw 2026.8.1.
RemediationAI
Apply the vendor-released patch: upgrade OpenClaw to 2026.8.1 or later as documented in GitHub advisory GHSA-7jfq-rmfm-29wp. Because the flaw abuses persisted standing grants, upgrading alone does not invalidate approvals already recorded in existing deployments, so administrators should also audit and revoke pre-existing 'allow-always' file-transfer approvals and re-issue them only for exact, canonical, non-glob paths tied to clearly identified nodes; this breaks unattended transfer automation until it is re-established, which is the primary trade-off. Where immediate upgrading is not possible, reduce exposure by disabling or restricting the agent's file-transfer capability, blocking glob patterns in approval and request paths, forcing per-transfer confirmation instead of allow-always (increased operator friction and reduced throughput), and avoiding duplicate or ambiguous node display names so approvals cannot resolve to a different node; additionally restrict which senders may interact with the agent so unvetted low-privilege users cannot attempt the path/name confusion. None of these compensating controls address the underlying authorization logic, so treat them as temporary until the 2026.8.1 upgrade is in place, and monitor file-transfer activity for reads or writes outside previously approved paths.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an incorrect authorization class (CWE-863): OpenClaw persists operator 'allow-always' decisions for file transfers as standing grants, and the matching logic used to apply those grants is not canonicalized or constrained tightly enough. Two distinct confusion vectors are described: glob metacharacter interpretation, where wildcard characters in an approved path or in a requested path cause the stored grant to match unintended sibling locations, and node display-name reuse, where an attacker-controlled or reused display name causes the approval to resolve to a different node than the one the operator originally authorized. Both are failures of authorization-scope binding rather than memory-safety or injection flaws, so the impact is confined to read and write access to files reachable by the agent's transfer capability, with no availability effect. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P, VC:H/VI:H/VA:N, no subsequent-system impact) aligns with the independent 3.1 assessment (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N), which explicitly notes that Attack Requirements are Present (AT:P) due to the need for a pre-existing allow-always grant and a low-privilege sender already admitted to the agent.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable but requires an admitted low-priv sender (PR:L), a prior operator approval (UI:R) and winning glob/name interpretation (AC:H); file read+write give C:H/I:H, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope.
Articles & Coverage 1
Technical POC Analysis
CWE-863 (Incorrect Authorization).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenClaw versions prior to 2026.8.1 contain a high-severity authorization flaw that can let an authenticated low-privilege user leverage a previously granted file-transfer approval to access files or nodes beyond what the operator intended, risking unauthorized data disclosure and tampering. Organizations relying on OpenClaw for automated file handling should treat this as a priority patching event because the vulnerability directly impacts data confidentiality and integrity, even though exploitation requires specific preconditions. No public exploit identified at time of analysis and the issue is not confirmed as actively exploited, but the potential for insider or compromised-account abuse warrants immediate leadership attention.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB