EUVD-2026-25274
GHSA-qgx9-6px9-7p75
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Trusted-proxy callers are already low-privilege authenticated users (PR:L); only media file confidentiality is impacted (C:L) with no integrity, availability, or scope-change effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope to access protected assistant-media files and metadata. Attackers can bypass identity-bearing HTTP auth path scope validation to retrieve sensitive media content within allowed media roots.
AnalysisAI
Scope enforcement bypass in OpenClaw's Control UI assistant-media route allows authenticated trusted-proxy callers lacking the operator.read scope to read protected assistant-media files and metadata. Affected versions are all OpenClaw npm releases before 2026.4.20; deployments not using trusted-proxy authentication mode are unaffected. No active exploitation is confirmed (absent from CISA KEV), EPSS is 0.03% (7th percentile), and SSVC rates exploitation as none with only partial technical impact, making this a low-urgency patch cycle item.
Technical ContextAI
OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is an npm-distributed AI gateway whose Control UI exposes an /__openclaw__/assistant-media HTTP route for serving assistant media files and metadata. The route's authorization logic in src/gateway/control-ui.ts (handleControlUiAssistantMediaRequest) correctly enforced gateway authentication and media-root boundary checks but omitted the call to authorizeOperatorScopesForMethod('assistant.media.get', ...) for trusted-proxy callers using identity-bearing HTTP auth paths (i.e., auth modes other than token, password, or none). Because the x-openclaw-scopes header was read but never validated against the required operator.read scope, any trusted-proxy-authenticated caller could retrieve media regardless of its declared scope set. The root cause is CWE-863 (Incorrect Authorization): the system authenticated the caller but failed to verify the caller held sufficient authorization for the requested operation.
RemediationAI
Upgrade the openclaw npm package to version 2026.4.20 or later, which enforces operator.read scope validation on all assistant-media file and metadata requests made over identity-bearing HTTP auth paths; the fix is in commit 99ef3a63c58440d53f8e45ad861b846032fcb036 (https://github.com/openclaw/openclaw/commit/99ef3a63c58440d53f8e45ad861b846032fcb036). If an immediate upgrade is not feasible, operators can mitigate by ensuring no trusted-proxy service account is granted route access without also being explicitly assigned the operator.read scope at the identity provider level - this limits exposure but requires careful scope auditing and does not eliminate the underlying code flaw. As a stronger compensating control, temporarily restricting or disabling the /__openclaw__/assistant-media route at the gateway or network layer eliminates the attack surface entirely at the cost of Control UI assistant media functionality.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today