EUVD-2026-96922
GHSA-w679-vj8x-2q83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach port 18790 on adjacent network
-
DeliverySend POST /pinclaw/send with no authToken
-
ExploitBypass skipped authentication check
-
ExecutionInject blind prompts into OpenClaw agent session
-
ImpactAgent acts on attacker instructions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The pinclaw OpenClaw channel plugin (version ≤0.3.0) must be installed and running with its HTTP router listening on port 18790, which binds all interfaces (0.0.0.0) by default. Because the authToken check is skipped specifically on POST /pinclaw/send, no credentials or user interaction are required (PR:N/UI:N). The key limiting factor is network position: the vendor's AV:A rating means the attacker must have adjacent/LAN reachability to the victim host (e.g., same Wi-Fi or subnet), not arbitrary internet access - exposure widens only if the host's port 18790 is routed or forwarded to untrusted networks. |
| Impact | This is a genuine authentication-bypass flaw (CWE-306) but the real-world risk is moderate rather than urgent. The provided CVSS 4.0 vector (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) scores 7.1 driven almost entirely by VI:H (integrity) - the attacker injects instructions but gains no direct confidentiality or availability impact. The attack vector is AV:A (adjacent), which contains and lowers exposure to the local network segment, not the open internet. Note a conflict worth verifying: the description says port 18790 'binds all interfaces by default,' which usually implies network reachability (AV:N), yet the vendor assigned AV:A - likely because pinclaw is a personal/workstation agent tool whose realistic exposure is the LAN; verify intended exposure with the vendor if the host is internet-facing. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public exploit was supplied - only a VulnCheck advisory and a hackmd technical writeup. On balance this is a real but lower-priority issue: high CVSS but constrained by adjacent-only reach, no confirmed active exploitation, and a niche product footprint. The secondary impact (an injected prompt causing the OpenClaw agent to take actions on the user's behalf) could escalate consequences, but the base metrics capture only direct integrity loss. |
| Exploit ScenarioDerived | An attacker on the same local network as a victim running the pinclaw OpenClaw channel plugin (≤0.3.0) sends a crafted HTTP POST to /pinclaw/send on port 18790, which skips the authToken check. The payload injects blind prompts that the victim's main OpenClaw agent session processes as legitimate user instructions. A technical writeup exists on hackmd but no weaponized public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Blind prompt injection into a user's OpenClaw agent session is possible through the Pinclaw channel plugin version 0.3.0 and earlier, because the HTTP router skips the authToken check on POST /pinclaw/send. The service binds all interfaces on port 18790 by default, but per the assessed CVSS vector exploitation requires adjacent-network access (same LAN or Wi-Fi) rather than arbitrary internet reachability, so real-world risk is moderate rather than urgent. Successful abuse lets an unauthenticated attacker plant instructions into the victim's agent session, affecting integrity only; no public exploit code has been identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis for CVE-2026-108757, which affects the Pinclaw plugin through version 0.3.0. The most direct compensating control is to stop the HTTP router from binding all interfaces: change the bind address in src/core/server.ts so port 18790 listens only on 127.0.0.1, which blocks LAN-based attackers but also prevents legitimate remote channel clients from connecting. If remote use is required, firewall TCP 18790 to trusted subnets only or block it from untrusted segments entirely - again a trade-off that breaks remote integrations. Placing an authenticating reverse proxy in front of /pinclaw/send and restricting source IPs provides additional coverage at the cost of added infrastructure complexity. Disabling the Pinclaw channel plugin entirely removes exposure but sacrifices the OpenClaw channel feature. Monitor logs for unexpected POST requests to /pinclaw/send to detect attempted abuse, and consult the VulnCheck advisory and the public writeup for further technical detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-108757 is a CWE-306 missing authentication flaw in the Nexting Pinclaw OpenClaw channel plugin, a Node/TypeScript component whose HTTP routing logic lives in src/core/http-router.ts. Specifically, the POST /pinclaw/send handler (source reference lines 296-330) intentionally or accidentally bypasses the authToken verification that protects other routes, meaning requests reaching that endpoint are treated as trusted user instructions and forwarded into the OpenClaw agent's main session. The companion server bootstrap in src/core/server.ts binds the listener on port 18790 across all interfaces (0.0.0.0) by default. The CPE cpe:2.3:a:nexting:pinclaw:*:*:*:*:*:*:*:* marks the entire package as affected through 0.3.0, matching the npm package 'pinclaw'. No public exploit code has been identified at time of analysis, though a public technical writeup describes how the unauthenticated agent injection works.
Know when Pinclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Default all-interface bind reachable from the LAN gives AV:A/AC:L and the skipped authToken check gives PR:N/UI:N; impact is integrity-only (injected instructions), so C:N/I:H/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into the user's main OpenClaw agent session as user instructions.
Executive ViewAI
OpenClaw deployments using the Pinclaw channel plugin version 0.3.0 and earlier are exposed to a high-severity prompt injection flaw that allows attackers on the same local network to insert instructions into user agent sessions, compromising the integrity of agent-driven workflows. No public exploit identified at time of analysis, and no vendor patch is available, but the adjacent-network vector means organizations must enforce network segmentation and monitor agent activity to prevent unauthorized manipulation. Leadership should care because compromised agent sessions can lead to erroneous business actions or data corruption, eroding trust in automation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to TCP port 18790 to trusted LAN/Wi-Fi segments, disabling or removing the Pinclaw channel plugin version 0.3.0 and earlier if not required, and monitoring for anomalous POST /pinclaw/send requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB