Openclaw EUVD-2026-13947

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N indicates a network-accessible vulnerability with high attack complexity, requiring no privileges or user interaction, with low integrity impact and no confidentiality or availability impact. The high complexity factor (AC:H) and limited scope (integrity only, no confidentiality breach) reduce the practical exploitability despite network accessibility. While no EPSS score or KEV status was provided in the intelligence, the vulnerability's low CVSS (3.7) combined with the high attack complexity suggests moderate real-world risk. The availability of a vendor patch and specific commit hash (2aa7842adeedef423be7ce283a9144b9f1a0a669) indicates the vendor has validated and resolved the flaw, lowering urgency for organizations that can patch promptly. This is not a critical vulnerability despite touching authorization logic; the high complexity barrier and limited impact scope position it as a lower-priority remediation target compared to high-CVSS or actively exploited flaws.

An attacker on the internet identifies an OpenClaw instance and crafts a signal reaction notification packet targeting a session they lack authorization to access (such as a group chat or DM they are not a member of). Due to the high attack complexity, the attacker must overcome network-level defenses or application-level timing constraints, but upon successful delivery, the malicious reaction event is enqueued into the target session's event queue before the authorization check executes. This allows the attacker to inject a reaction status line into a protected session, causing minor integrity compromise by injecting unsolicited reaction data without triggering access denial errors. No public proof-of-concept is known to exist, and the high complexity barrier makes opportunistic exploitation unlikely.