Openclaw EUVD-2026-13949

OpenClaw versions prior to 2026.3.1 in scoped-token deployments. Attacker requires authenticated access with operator.write scope. Exploits authorization bypass to invoke owner-only tool surfaces (gateway, cron) via agent runs without victim interaction required.

The CVSS 3.1 score of 8.8 reflects genuine severity with network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L), indicating authenticated attackers can easily exploit this without special conditions. The vulnerability enables full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) within the control plane scope. Real-world risk is elevated because the attack requires only authenticated write-scope access, which is commonly granted to operators and developers in workflow systems, and the exploitation complexity is low with no user interaction needed. However, mitigating factors include the requirement for authentication and the vulnerability being specific to scoped-token deployments rather than all configurations. Without EPSS data, KEV listing, or reported exploitation, this appears to be a newly disclosed vulnerability with patch availability, making it a high priority for affected organizations but not yet an actively exploited threat. The technical impact of control-plane compromise and the ease of exploitation make this a genuine priority for patching in environments using scoped tokens.

An attacker with legitimate operator.write credentials authenticates to an OpenClaw scoped-token deployment and crafts an agent run workflow that invokes owner-only tool surfaces such as gateway configuration or cron job management. Because the authorization checks fail to consistently enforce owner-level permissions during agent execution, the attacker successfully executes privileged control-plane operations, potentially creating persistent backdoors through cron jobs, modifying gateway routing to intercept traffic, or escalating to full administrative control over the OpenClaw infrastructure. The low attack complexity and network accessibility mean this can be exploited remotely without specialized tools once an attacker obtains operator-level credentials.