openclaw-cn CVE-2026-19007

Exploitation requires at minimum low-level authenticated access to the openclaw-cn application, as confirmed by the PR:L metric in the CVSS 4.0 vector - unauthenticated remote exploitation is not indicated. The vulnerable code path is activated only when the elevated-sender auto-reply feature (reply-elevated.ts) is enabled in the deployment; if this feature is disabled or unused, the attack surface does not exist. No special network positioning is required - the attack is fully network-accessible (AV:N) with no attack-specific prerequisites (AT:N). Exploitation is bounded by the low CIA impact scores, meaning successful privilege escalation grants elevated messaging permissions within the application rather than host-level or system-level compromise. No specific operating system, runtime version, or external dependency configuration was identified as a condition beyond the above.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) reflects a remotely exploitable, low-complexity privilege escalation with limited CIA impact and no scope change to subsequent systems. The E:P exploit maturity tag and the public GitHub issue #564 confirm POC availability, which meaningfully lowers the skill barrier for exploitation beyond what the base score alone communicates. The vulnerability is NOT in the CISA KEV catalog, and no EPSS probability score was provided, so population-level exploitation frequency cannot be quantified. The most significant risk mitigator is the PR:L requirement - unauthenticated exploitation is not indicated by the CVSS vector. The most significant risk amplifier is vendor non-response: no patch has been released, leaving operators without an authoritative remediation path. For organizations actively using openclaw-cn's elevated-reply feature, this is a real operational priority; for the broader security community, the obscure footprint limits widespread impact.

A remote attacker with low-level authenticated access to an openclaw-cn instance sends a specially crafted message or API request designed to manipulate the logic of the isApprovedElevatedSender function, causing it to return a positive approval for elevated sender status despite the attacker's low privilege level. With this bypass in place, the attacker can trigger auto-reply behaviors restricted to elevated senders, potentially accessing restricted messaging channels, exfiltrating data visible only to privileged senders, or injecting content under a trusted elevated identity. The publicly available proof-of-concept on GitHub issue #564 significantly lowers the skill barrier required to execute this attack.