Openclaw EUVD-2026-16995

Attacker must have command authorization in OpenClaw before version 2026.3.12. Requires authenticated access with command privileges (non-owner account). No victim interaction needed. Affects /config and /debug command handlers allowing unauthorized access to owner-only settings.

The CVSS 4.0 score of 8.7 reflects high severity driven by network attack vector (AV:N), low complexity (AC:L), and high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H). However, the attack requires low-level privileges (PR:L), meaning attackers must first obtain command authorization credentials, which significantly constrains the attack surface compared to unauthenticated vulnerabilities. No EPSS score is provided, and KEV status is not confirmed, indicating no evidence of active exploitation at time of analysis. No public exploit identified at time of analysis, though the GitHub Security Advisory and VulnCheck publication mean technical details are publicly documented, lowering exploitation barriers for insiders or attackers who have already compromised low-privilege accounts. From an SSVC perspective: exploitation status is public (advisory published), automatable is likely YES given simple HTTP requests to documented endpoints, and technical impact is total given the ability to modify owner-level configurations. Real-world risk is HIGH for organizations using OpenClaw where insider threats or credential compromise are concerns, but MODERATE in environments with strong perimeter controls since initial command-level access is prerequisite. This is a genuine priority for OpenClaw deployments, not a theoretical high-CVSS issue, because the exploitation path is straightforward once an attacker obtains any legitimate command authorization.

An attacker who has obtained legitimate command authorization credentials (either through phishing, credential stuffing, or insider access) authenticates to the OpenClaw application over the network. Despite holding only command-level privileges, the attacker directly requests the /config endpoint and successfully retrieves owner-restricted configuration data, including sensitive parameters such as API keys, database connection strings, or security settings. The attacker then modifies critical configurations via the same endpoint-for example, disabling security features, adding backdoor administrative accounts, or redirecting data flows to attacker-controlled systems. Because the vulnerability requires only low-complexity HTTP requests to documented endpoints and no user interaction, exploitation is straightforward for anyone with command credentials, making this particularly dangerous in environments with multiple privilege tiers or where former employees retain low-level access.