EUVD-2026-28178Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered queued outbound media to bypass group tool policy enforcement and weaken channel media restrictions after service restart or recovery.
AnalysisAI
OpenClaw versions 2026.4.10 through 2026.4.13 fail to persist session context when recovering queued outbound media after service restart, allowing authenticated attackers to bypass group tool policy enforcement and weaken channel media restrictions. The vulnerability affects the delivery queue recovery mechanism, which replays queued messages without the original requester's session context needed for policy validation. Exploitation requires authenticated access and prior knowledge of queued delivery entries, with CVSS 6.0 and confirmed patch available in version 2026.4.14.
Technical ContextAI
OpenClaw is a Node.js/npm-based communication delivery platform that manages outbound media dispatch through a write-ahead delivery queue. The vulnerability resides in the session context persistence layer across three modules: delivery-queue-storage.ts (queue persistence), delivery-queue-recovery.ts (queue replay), and deliver.ts (media transmission). The root cause is CWE-862 (Missing Authorization), manifesting as missing session context fields during delivery queue recovery. When messages are queued for delivery, the originating OutboundSessionContext object-containing requesterAccountId, requesterSenderId, agentId, and sender metadata-is not persisted to the queue storage. During recovery after restart, the queued entries are replayed without this context, causing policy checks that depend on session identity to fail or be skipped, effectively removing authorization controls that restrict which media types can be sent per group policy. The fix adds optional session field to QueuedDeliveryPayload type and propagates it through enqueueDelivery, buildRecoveryDeliverParams, and deliverOutboundPayloads functions.
RemediationAI
Upgrade OpenClaw to version 2026.4.14 or later immediately. Users can execute npm update openclaw@2026.4.14 or npm install openclaw@2026.4.14 to obtain the patched version, which includes PR #66025 that adds session context persistence to the delivery queue. Organizations unable to upgrade immediately should implement compensating controls: disable automatic queue recovery after unplanned restarts by setting recovery mode to manual-only (trade-off: queued messages may not deliver until explicit recovery is initiated); restrict access to queue storage files to prevent unauthorized queue manipulation; implement per-message audit logging of delivery queue recovery events to detect policy-bypass attempts; or temporarily disable group tool policy for media channels and enforce policies at application boundary until upgrade is complete. The fix is confirmed in commit 48aae82bbc19ba8b0741e61a08063eb0d1df464e. For detailed advisory, see https://www.vulncheck.com/advisories/openclaw-loss-of-group-tool-policy-context-in-delivery-queue-recovery.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today