EUVD-2026-33743
GHSA-q6qc-xp4q-rjq5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.
AnalysisAI
Missing authentication in Enderfga claw-orchestrator's embedded HTTP server (src/embedded-server.ts, EmbeddedServer class) exposes all API endpoints to unauthenticated network access in versions 3.5.5 and earlier, because the OPENCLAW_SERVER_TOKEN authentication mechanism was opt-in rather than enforced by default. Any attacker with network access to the server port can interact with the orchestration management API without credentials. A publicly available proof-of-concept exists (referenced in GitHub issue #61); this vulnerability is not confirmed in CISA KEV at time of analysis, though the CVSS 4.0 E:P exploit maturity modifier confirms public PoC availability.
Technical ContextAI
claw-orchestrator is a Node.js/TypeScript orchestration tool that exposes a local management interface via an embedded HTTP server implemented in src/embedded-server.ts. The root cause is CWE-306 (Missing Authentication for Critical Function): in versions up to 3.5.5, authentication was gated entirely on the operator explicitly setting the OPENCLAW_SERVER_TOKEN environment variable. Default deployments omitting this variable received no authentication enforcement on any endpoint. The fix in 3.5.6 inverts this design - the server auto-generates a cryptographically random 32-byte token written to ~/.openclaw/server-token (mode 0600) at startup when the variable is unset, making authentication the unconditional default. The affected CPE is cpe:2.3:a:enderfga:claw-orchestrator:*:*:*:*:*:*:*:* covering all releases through 3.5.5.
RemediationAI
The primary fix is upgrading to claw-orchestrator v3.5.6, available at https://github.com/Enderfga/claw-orchestrator/releases/tag/v3.5.6 (patch commit d0b02a800aa0689d9428cc4cc170e0b6589fb2c3). Post-upgrade, the server auto-generates and enforces a token by default with no operator action required; the clawo CLI reads the token automatically from environment variables or ~/.openclaw/server-token. As an immediate compensating control on versions 3.5.5 and earlier without upgrading, operators can set OPENCLAW_SERVER_TOKEN to a strong random value in the server's environment, which activates the existing auth enforcement - this closes the unauthenticated exposure but requires manual token distribution to all CLI consumers and does not benefit from the auto-generation or cookie-based browser flows introduced in 3.5.6. Additionally, restricting inbound network access to the embedded server's port via firewall rules (limiting connections to localhost or trusted management IPs) prevents remote exploitation regardless of auth state, at the cost of losing remote management capability. Setting OPENCLAW_SERVER_TOKEN=disabled in 3.5.6+ re-enables unauthenticated access and should only be used on confirmed single-user hosts with no network exposure.
More in Claw Orchestrator
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today