Openclaw CVE-2026-22174

This vulnerability presents a moderate-to-high real-world risk despite its 5.7 CVSS score (Medium), which reflects the attack vector limitation (Local only) and high complexity (user interaction or specific system configuration required). The CVSS vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) correctly captures that local attackers without privileges can achieve high confidentiality impact (token disclosure) and limited integrity impact (token reuse for unauthorized actions). The presence of a vendor patch and public GitHub advisory indicates active disclosure and reasonable vendor response time. The automation potential is moderate: while token capture is straightforward (packet sniffing on loopback), exploitation requires controlling a loopback port or intercepting CDP traffic, which has higher complexity than network-based attacks. Under SSVC, this rates as Medium-High priority for systems where local process isolation cannot be guaranteed (containers, shared systems, development environments). Organizations running OpenClaw in multi-tenant or loosely-isolated environments should prioritize patching; isolated production deployments face lower risk but still warrant timely updates.

A developer on a shared build machine or container host with OpenClaw installed runs a locally-developed tool that listens on a high-numbered loopback port. When OpenClaw's Gateway initiates a Chrome CDP reachability probe to /json/version on 127.0.0.1:9222 (or similar), the attacker's tool intercepts the HTTP traffic and extracts the x-OpenClaw-relay-token header. The attacker then crafts an HTTP request to the OpenClaw Gateway API endpoint (e.g., https://openclaw.internal/api/admin) with Authorization: Bearer [stolen_token], gaining authenticated access to Gateway functionality without credentials. This is feasible with minimal complexity tools (netcat, tcpdump, curl) and requires only local system access, making it a realistic threat in development, CI/CD, and shared infrastructure scenarios.