EUVD-2026-27281Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, causing earlier messages to execute with elevated permissions.
AnalysisAI
Authorization context reuse in OpenClaw's collect-mode queue batching allows attackers with low-privilege accounts to execute messages with elevated permissions inherited from subsequent higher-privileged senders. The vulnerability occurs when messages from multiple senders are batched together, causing earlier queued messages to execute under the authorization context of the final sender in the batch rather than their own. Vendor-released patch (version 2026.4.14) confirmed available via GitHub advisory GHSA-jwrq-8g5x-5fhm and commit 43d4be9. No public exploit identified at time of analysis.
Technical ContextAI
OpenClaw is an npm package implementing an auto-reply and message queue system with multiple processing modes. The vulnerability affects the 'collect-mode' queue batching mechanism, which aggregates multiple queued messages for batch dispatch. The root cause (CWE-266: Incorrect Privilege Assignment) stems from the queue draining logic failing to preserve per-message authorization contexts when batching. Before the fix in PR #66024, the system would group all pending messages in a collect-mode queue into a single batch and execute them using the authorization context (sender ID, owner status, exec/bash-elevated overrides) of the last message added to the batch. The patch introduces authorization-aware batch splitting via a new resolveFollowupAuthorizationKey function that segments batches into contiguous groups by sender authorization context, ensuring each message executes with its original trust state. CPE cpe:2.3:a:openclaw:openclaw identifies the affected product as the OpenClaw npm package across all pre-patch versions.
RemediationAI
Upgrade to OpenClaw version 2026.4.14 or later, which contains the authorization context splitting fix from commit 43d4be902755c970b3d15608679761877718da69 (PR #66024). The npm package openclaw@2026.4.14 is confirmed available and includes the patch per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-jwrq-8g5x-5fhm. For environments unable to upgrade immediately, disable collect-mode queue batching if the feature is not operationally required, which eliminates the vulnerable code path entirely but sacrifices the performance benefits of message aggregation. Alternatively, restrict OpenClaw deployments to single-privilege-level user populations (all owners or all non-owners) to prevent cross-privilege batch formation, though this significantly limits the platform's multi-user capabilities and does not address exec/bash-elevated override context reuse. Organizations using OpenClaw in security-sensitive contexts should prioritize the upgrade path as workarounds substantially reduce functionality.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today