EUVD-2026-26087
GHSA-gjm7-hw8f-73rq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain paired node credentials
-
DeliveryAuthenticate as role=node
-
ExploitCraft malicious node.event request
-
ExecutionDispatch unrestricted agent.request to gateway
-
PersistExecute arbitrary code on gateway
-
ImpactAchieve full gateway compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must possess valid credentials for a paired node with role=node within the OpenClaw deployment. The paired node feature must be enabled on the gateway, which is a non-default configuration requiring explicit setup of node pairing and role assignment. The gateway must accept node.event agent requests from the compromised paired node, which requires the node to be in an active paired state with valid authentication tokens. These conditions limit exploitation to environments actively using OpenClaw's distributed node architecture rather than standalone gateway deployments. User interaction is not required (UI:N), and the attack complexity is low (AC:L) once paired node credentials are obtained, but the attack complexity threshold (AT:P) indicates the specific paired node deployment configuration must be present. |
| Impact | This represents a significant real-world risk for OpenClaw deployments with paired node architectures. The CVSS 7.7 score accurately reflects the severity: network-accessible (AV:N) with low complexity (AC:L) and low privilege requirements (PR:L) leads to complete gateway compromise (high CIA impact). The AT:P (Attack Complexity Present) modifier suggests specific deployment conditions must exist, which aligns with the requirement for trusted paired node credentials. While no EPSS score or KEV listing is available yet (recent 2026 disclosure), the public availability of both a detailed vendor advisory and the specific commit fixing the issue (a77928b1087e) significantly increases exploitation likelihood. The VulnCheck advisory provides technical details that could enable reproduction. Organizations using OpenClaw's paired node feature with role=node configurations face immediate risk, as the attack path from authenticated node to gateway RCE is well-documented. Priority should be HIGH for environments actively using the paired node functionality, MEDIUM for OpenClaw deployments without paired nodes enabled. |
| Exploit ScenarioDerived | An attacker who has compromised credentials for a paired node with role=node (either through credential theft, insider access, or compromise of a legitimate node system) authenticates to the OpenClaw gateway. The attacker crafts malicious node.event agent requests containing agent.request dispatch commands that invoke restricted gateway-side tools. Due to missing authorization checks, the gateway processes these requests with elevated privileges, allowing the attacker to execute arbitrary code on the gateway system with gateway-level permissions, achieving full control over the OpenClaw control plane and potentially pivoting to managed infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 28, 2026
Remote code execution in OpenClaw gateway versions before 2026.3.31 allows attackers with trusted paired node credentials (role=node) to escalate privileges and execute arbitrary code on the gateway by abusing unrestricted agent.request dispatch functionality. The vulnerability stems from insufficient access controls on node.event agent requests, enabling low-privilege paired nodes to invoke gateway-side tools without restriction. EPSS exploitation probability and KEV status not yet available for this recently disclosed vulnerability, but a vendor patch and exploit details are publicly documented.
RemediationAI
Upgrade immediately to OpenClaw version 2026.3.31 or later, which contains authorization fixes for node.event agent request handling as detailed in commit a77928b1087e90f2a8903f8e5aca6dec9237ac62 available at https://github.com/openclaw/openclaw/commit/a77928b1087e90f2a8903f8e5aca6dec9237ac62. If immediate patching is not feasible, implement compensating controls: disable or remove all paired nodes with role=node until patch deployment, restrict network access to the gateway's node.event endpoint to only trusted IP ranges using firewall rules (noting this reduces functionality and requires maintaining IP allowlists), and audit existing paired node credentials for unauthorized entries or compromised accounts. These workarounds significantly limit OpenClaw's distributed capabilities and should be considered temporary measures only. Review gateway logs for suspicious agent.request patterns from paired nodes prior to patching to identify potential exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a distributed automation or orchestration platform that operates on a gateway-controller architecture with paired nodes communicating via event-based agent requests. The vulnerability (CWE-862: Missing Authorization) exists in the node.event agent request handling mechanism prior to version 2026.3.31. Paired nodes with role=node status are intended to have limited capabilities, but the gateway fails to properly validate authorization when processing agent.request dispatch commands. This authorization bypass allows low-privilege nodes to invoke gateway-side tools and functions that should be restricted to higher privilege contexts. The CVSS 4.0 vector indicates network-accessible attack requiring low privileges (PR:L) and attack complexity with present conditions (AT:P), resulting in complete compromise of gateway confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with no impact to subsequent systems (SC:N/SI:N/SA:N).
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote code execution on the gateway.
Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
Executive ViewAI
OpenClaw gateway versions before 2026.3.31 contain a remote code execution vulnerability that allows paired nodes with low-privilege credentials to execute arbitrary code on the gateway through unrestricted agent request dispatch. Organizations using OpenClaw in multi-node deployments face immediate risk of lateral movement and full gateway compromise by any compromised or malicious paired node.
Apply vendor patch. If immediate patching is not possible: restrict network access to OpenClaw gateways to trusted paired nodes only; disable or restrict the agent.request dispatch functionality if configuration options exist; implement strict credential rotation for all paired node accounts; monitor gateway logs for abnormal agent.request activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB