Openclaw EUVD-2026-17026

Requires authenticated access to OpenClaw gateway agent RPC with operator.write permission. Attacker must be an authenticated operator who can supply malicious spawnedBy and workspaceDir parameters to bypass workspace boundaries. Affects OpenClaw versions before 2026.3.11.

Real-world risk is HIGH for organizations deploying OpenClaw with multiple operator roles. CVSS 8.7 (AV:N/AC:L/PR:L) indicates network-exploitable attack requiring only low-privilege authentication with no user interaction, yielding high impact across confidentiality, integrity, and availability. Attack complexity is LOW, making this readily exploitable by any authenticated operator with operator.write permission-likely a common role assignment. No public exploit identified at time of analysis and not listed in CISA KEV, suggesting exploitation is theoretical rather than confirmed active. However, the technical barrier is minimal: attackers need only craft RPC calls with modified directory parameters, making this automatable if operators have network access to the gateway agent. The SSVC decision framework suggests ATTEND priority: technically exploitable with high impact but no confirmed exploitation status. VulnCheck's information disclosure tag indicates potential for credential harvesting or sensitive file access beyond the primary workspace escape vector. Organizations granting operator.write to untrusted or semi-trusted users face immediate risk, while those with strict operator vetting have reduced exposure but should still prioritize patching given the low attack complexity.

An authenticated operator with operator.write permission connects to the OpenClaw gateway agent RPC interface over the network. The attacker crafts RPC requests with spawnedBy and workspaceDir parameters pointing to sensitive directories such as /etc/shadow, /root/.ssh, or application configuration paths outside their designated workspace boundary. The agent processes these requests without re-validating workspace constraints, executing file read operations to exfiltrate credentials or exec operations to launch processes with modified environment contexts. The attacker leverages this to access confidential data across workspace boundaries, modify critical system files, or establish persistence through unauthorized process execution, all while appearing as legitimate operator activity within audit logs.