EUVD-2026-87493
GHSA-8j8h-vv2f-mp26
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthorized non-owner gains skill command access
-
DeliveryCraft skill command invoking owner-only tool
-
ExploitDispatch fails to carry owner status
-
ExecutionTool executes with owner authorization
-
ImpactExfiltrate server credentials and owner data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a deployment where senders that are NOT owners are nonetheless authorized to invoke skill commands (multi-sender or multi-tenant OpenClaw configuration). The attacker must already hold that authorized non-owner sender role - this is the PR:L prerequisite - but needs no user interaction and no owner credentials. The flaw is that skill tool dispatch does not propagate the sender's owner status, so the limiting factor is purely whether non-owner principals with skill-command access exist; single-owner or no-external-sender deployments are not exposed. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:L) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, scoring 8.7. However, this rating hinges on the fact that the attacker must already be an authorized non-owner sender who can invoke skill commands - the PR:L reflects that pre-existing authorized (but non-owner) access is a hard prerequisite, so this is not a wide-open unauthenticated bug. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Weighing signals together: the technical impact is genuinely high (owner-only tools plus server credential disclosure, a privilege-boundary break within CWE-863), but real-world risk is tempered by the niche footprint of OpenClaw and the requirement for an already-authorized non-owner principal. This is a meaningful privilege-escalation/authorization bug for the small population that runs OpenClaw with multiple senders of differing trust, but it is not a broad internet-facing emergency; treat it as MEDIUM operational priority pending patch, higher for multi-tenant deployments. |
| Exploit ScenarioDerived | In an OpenClaw deployment where non-owner senders are permitted to invoke skill commands, a low-trust sender issues a skill command that dispatches to a tool intended only for owners. Because the dispatch path drops the sender's owner status, the request is executed with owner-level authorization, returning owner-only tool results and reserved server credentials. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Authorization bypass in OpenClaw versions before 2026.8.1 lets an authenticated, low-privileged sender who is permitted to invoke skill commands reach owner-only tools and owner-reserved server credentials, because skill tool dispatch does not propagate the sender's owner status into the tool authorization decision. Exploitation requires only the PR:L prerequisite defined by the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, base 8.7) - no owner credentials and no user interaction - and yields high confidentiality and integrity impact with limited availability impact, so the practical exposure is confined to multi-sender or multi-tenant OpenClaw deployments in which non-owner principals have been granted skill-command access; single-owner or no-external-sender deployments are not exposed. No public exploit identified at time of analysis, and this CVE is not reported as confirmed actively exploited (CISA KEV); a vendor security advisory (GHSA-7cp7-87pj-p32v) and a VulnCheck advisory are available, and the fixed release is 2026.8.1.
RemediationAI
Vendor-released patch: upgrade OpenClaw to 2026.8.1 or later, which restores propagation of the sender's owner status through skill tool dispatch; see the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-7cp7-87pj-p32v and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authorization-bypass-via-skill-tool-dispatch. If upgrading cannot be done immediately, the effective compensating control is to eliminate the PR:L prerequisite by revoking skill-command authorization from every non-owner sender (restrict skill invocation to the owner principal only) - this removes the attack path entirely because the bypass requires an already-authorized non-owner sender, but the trade-off is that shared or multi-tenant skill usage stops working until the upgrade is applied. As a secondary measure, disable or sandbox skill tool dispatch for non-owner principals at the policy layer rather than relying on per-tool permission flags, since the defect is precisely that per-tool owner checks are not applied; this may break automation that expects non-owner senders to run skills. Because owner-reserved server credentials are the stated impact, treat any window of exposure as a credential compromise: rotate server credentials and any secrets reachable by owner-only tools, and review audit logs for skill-command invocations by non-owner senders to determine whether unauthorized tool execution or credential access occurred. Network-level restriction of the OpenClaw service to trusted senders reduces reachability (AV:N) but does not address the authorization gap for senders who are already permitted to connect, so it should not be treated as a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is an agent/assistant platform in which 'skills' are invokable tools, and skill tool dispatch is the internal routing layer that resolves a caller's request for a skill command into the execution of the underlying tools. The defect is classified as CWE-863 (Incorrect Authorization): the dispatch path authenticates and authorizes the sender for the skill command itself, but fails to carry the sender's owner flag (owner versus non-owner principal) forward when it selects and executes the concrete tool, so tool-level owner-only checks either never fire or evaluate against a mis-scoped principal context. The result is a privilege-context propagation gap rather than a missing authentication check - the attacker already holds a valid, authorized non-owner sender role, which is exactly why the CVSS vectors carry PR:L rather than PR:N. Both the vendor/CNAs CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) agree on network reachability, low attack complexity, low privileges, no user interaction, and high confidentiality/integrity impact, with only partial availability impact; the CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* denotes all OpenClaw releases prior to 2026.8.1 as affected. The security consequence is horizontal-to-vertical escalation inside the deployment: a non-owner sender can invoke owner-scoped tools and read server credentials that were reserved for the owner principal, which in turn can be used to pivot to whatever those credentials authorize.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Network-reachable via an already-authorized non-owner sender (PR:L, no UI); owner-only tools and credential disclosure give C:H/I:H, with limited availability impact (A:L) and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners.
Articles & Coverage 1
Technical POC Analysis
Evidence base: GitHub Security Advisory GHSA-7cp7-87pj-p32v (openclaw/openclaw).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenClaw versions prior to 2026.8.1 contain an authorization bypass that allows authenticated low-privileged users with skill-command access to reach owner-only tools and owner-reserved server credentials. This vulnerability primarily affects multi-tenant or multi-sender deployments where non-owner principals have been granted skill-command permissions, potentially leading to unauthorized access to sensitive data and system integrity. Leadership should prioritize remediation because the flaw exposes critical credentials and could undermine trust in multi-user environments, though no public exploit has been identified.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting skill-command access to owner accounts only, disabling non-owner skill command invocation, monitoring and auditing for unauthorized access to owner-only tools and credentials, implementing network segmentation, and applying workarounds from the vendor advisory GHSA-7cp7-87pj-p32v. These controls should remain in place until an official patch is available and deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB