EUVD-2026-87458
GHSA-hh5c-9248-jvc5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin/be admitted to group channel as authorized sender
-
DeliveryIssue owner-only /activation policy command
-
ExploitMissing owner-check accepts change
-
ExecutionAgent activation policy persistently altered
-
ImpactBroadened response exposure or suppressed activation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an OpenClaw agent (npm |
| Impact | This is a genuine but low-severity authorization flaw, not a high-CVSS scare. The vendor CVSS 4.0 base is 5.3 (VC:L/VI:L/VA:N), which aligns with the CWE-862 missing-authorization root cause: an already-authorized non-owner group member can toggle a policy setting they shouldn't control. The vector is network (AV:N), low complexity (AC:L), and requires only low privileges (PR:L - the actor must already be an admitted channel sender), with no user interaction (UI:N). Exploitation-probability signals reinforce the low ranking: there is no EPSS score, no CISA KEV listing, and no public exploit code - no public exploit identified at time of analysis. Impact is confined to information exposure (the agent replying to more group traffic) and mild integrity/availability degradation (suppressing activation until an owner reverts); there is no code execution, no host access, and no cross-system scope change (SC/SI/SA:N). No signals conflict - the CVSS vector, description, and CWE are mutually consistent. Net: real but low priority, a hardening/authorization-boundary fix rather than an urgent patch. The 'Authentication Bypass' tag overstates the class; this is an authorization (privilege-boundary) issue, not an authentication bypass. |
| Exploit ScenarioDerived | A non-owner but authorized member of a group channel where an OpenClaw agent is present issues the persistent |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Improper authorization in OpenClaw (npm package openclaw) before 2026.7.1 allows an authenticated non-owner sender in a group channel to persistently change the agent's /activation policy, so the documented owner-only restriction on that setting is not enforced. Successful abuse causes the agent to respond more broadly in the group - exposing its replies to additional channel traffic - or to suppress the mention-based activation behavior an operator expects, until an owner manually restores the setting. The issue is fixed in 2026.7.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a low-severity authorization flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than a high-impact vulnerability, since the attacker must already be an admitted channel participant and an owner can trivially revert the change.
RemediationAI
Upgrade the OpenClaw npm package to the vendor-released fixed version 2026.7.1 (the sole patched release identified), which enforces the documented owner-only restriction on persistent /activation policy changes; see the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-q9j5-4xr6-xqqw for the authoritative fix details. If an immediate upgrade is not possible, apply compensating controls that reconstruct the missing authorization check at the channel layer: restrict group channel membership so that only trusted operators can post (this directly removes the PR:L prerequisite, but reduces collaboration breadth and is impractical for large public groups); configure the chat platform's own command/permission allow-listing so the /activation command is only accepted from owner accounts (this may interfere with legitimate delegated administration and must be kept in sync with staff changes); and disable the agent or remove it from any group channel where mention-based activation is not essential, trading away functionality for safety. Because the change is persistent, operators should also audit current /activation policy state on every deployed OpenClaw instance and have an owner reset it to the intended value, since detection of the modification is otherwise silent. Note that the independent assessment confirms this is a low-severity authorization issue with no code execution or host-access path, so remediation should be prioritized accordingly rather than treated as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a Node.js chat-agent package distributed via npm that integrates with group channels and supports configurable activation policies, including mention-based activation. The root cause is CWE-862 (Missing Authorization): the agent's command handler processes the persistent /activation policy command without verifying that the issuer holds the owner role, even though the owner-only requirement is part of the documented policy model. Because the setting is persistent, the authorization gap is not transient - one accepted command durably alters how the agent decides when to speak. The CVSS vector confirms the access path (AV:N/AC:L, PR:L) is remote but requires low privileges, i.e., a sender already authorized to post in the channel; there is no unauthenticated vector, and the scope remains unchanged (S:U) with only low confidentiality and integrity impact (C:L/I:L) and no availability impact (A:N), reflecting that the effect is confined to the agent's activation behavior rather than code execution or host compromise. The CPE entry cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* and the EUVD record EUVD-2026-87458 both scope the flaw to all OpenClaw releases prior to 2026.7.1.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authorized non-owner sender gives PR:L over the network with no interaction; impact is limited to broadened response exposure (C:L) and toggling a policy setting (I:L), with no availability loss and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
OpenClaw (npm package openclaw) before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond more broadly in the group (exposing its responses to additional group traffic) or suppressing expected activation behavior until an owner restores the intended setting. The issue is fixed in version 2026.7.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB