EUVD-2026-53739
GHSA-f57q-9mhr-fhmm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low complexity, but PR:L required per CVSS 4.0 input; scope unchanged since no subsequent-system impact is indicated.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Privilege escalation in openclaw-cn (all versions up to 0.2.1) allows a remote attacker with low-level authentication to bypass the isApprovedElevatedSender privilege check in the auto-reply module and assume elevated sender permissions. A publicly disclosed proof-of-concept exploit exists on GitHub issue #564, and the project maintainer has not responded to the responsible disclosure report. No CISA KEV listing exists, but the low attack complexity combined with POC availability makes this a credible risk for any active deployment of the affected application.
Technical ContextAI
openclaw-cn is a TypeScript-based messaging automation or chatbot framework developed by mf-yang, identified by CPE cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*. The vulnerable code resides in the file src/auto-reply/reply/reply-elevated.ts within the function isApprovedElevatedSender, whose purpose is to determine whether a given message sender holds elevated (privileged) status before allowing privileged auto-reply behaviors. CWE-269 (Improper Privilege Management) indicates that the root cause is a failure to correctly enforce role or permission boundaries - likely through a logic flaw, bypassable condition, or insufficient sender identity validation - rather than a memory-safety or injection class issue. The CVSS 4.0 E:P enrichment tag confirms a working proof-of-concept has been made public.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the responsible disclosure despite early notification via GitHub issue #564. Operators should monitor the repository at https://github.com/mf-yang/openclaw-cn/ for a patched release. As an immediate compensating control, disable the elevated-sender auto-reply feature entirely if it is not operationally required - this removes the vulnerable code path in reply-elevated.ts at the cost of losing elevated-reply functionality. If disabling is not viable, restrict application access to the minimum set of trusted, authenticated users to reduce the pool of potential attackers who meet the PR:L prerequisite. Audit application logs for unexpected privilege escalation events indicative of exploitation attempts. Upstream fix availability should be tracked via the VulDB advisory at https://vuldb.com/vuln/386390.
More in Openclaw Cn
View allSymlink escape in openclaw-cn's apply_patch Tool allows authenticated remote attackers on versions up to 0.2.1 to traver
Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privile
Server-side request forgery in openclaw-cn up to version 0.2.1 via the Browser Control HTTP API enables authenticated re
Incorrect authorization in openclaw-cn 2026.2.5 allows authenticated remote attackers to bypass the Gateway Exec Approva
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today