EUVD-2026-26123Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low-privilege access required (PR:L per trust model); scope unchanged with availability-only impact (A:L), no confidentiality or integrity exposure.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memory exhaustion or denial of service through crafted base64-encoded input.
AnalysisAI
Memory exhaustion vulnerability in the OpenClaw npm package (all versions before 2026.4.8) allows authenticated network-accessible attackers to trigger denial of service by submitting crafted base64-encoded input to multiple affected decode paths, each of which allocates memory before enforcing decoded-size limits. The vendor explicitly scopes this vulnerability to OpenClaw's trust model as a user-controlled local assistant, not a multi-tenant service boundary, which meaningfully narrows real-world attack surface. No public exploit exists, CISA has not added this to KEV, and EPSS of 0.04% (11th percentile) confirms negligible exploitation activity at time of analysis.
Technical ContextAI
CWE-770 (Allocation of Resources Without Limits or Throttling) describes the root cause: base64 decoding routines that allocate heap memory sized to accommodate the decoded output before validating whether that decoded size falls within acceptable limits. An attacker-supplied encoded payload can encode arbitrarily large data, causing the allocator to claim unbounded memory before the bounds check ever executes. OpenClaw is distributed as an npm package (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) and functions as a user-controlled local AI assistant. The GHSA advisory (GHSA-ccx3-fw7q-rr2r) notes that multiple independent code paths share this flaw, expanding the exploitable surface within the library. The fix at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 on main was regression-tested before publication.
RemediationAI
Upgrade the openclaw npm package to version 2026.4.8 or later; this is the vendor-confirmed patched release corresponding to commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 on main, which was verified with targeted regression tests before publication. See the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-ccx3-fw7q-rr2r and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-improper-base64-decoding-size-validation for details. If immediate upgrade is not feasible, restrict the sources of base64-encoded input processed by OpenClaw to fully trusted, internally controlled systems, eliminating the ability of external or semi-trusted actors to submit crafted payloads; note this requires application-level controls outside OpenClaw itself and does not eliminate the underlying flaw. No vendor-documented workaround short of upgrading is available.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today