Openclaw EUVD-2026-21430

This vulnerability presents moderate real-world risk. The CVSS score of 4.3 with a network attack vector (AV:N), low complexity (AC:L), and low privilege requirement (PR:L) accurately reflects the threat model: an authenticated attacker with minimal privileges can trigger the flaw remotely with no user interaction. However, the impact is limited to confidentiality (C:L) with no integrity or availability impact, constraining the severity. The fact that authorization checks exist (but are inconsistent) suggests this is a logic error rather than a complete missing control. SSVC analysis: exploitation is straightforward (attackers need valid operator credentials with a specific minimal scope), the flaw is likely automatable via simple HTTP requests, and technical impact is low (metadata enumeration rather than code execution or privilege escalation). This is a legitimate priority for organizations using OpenClaw, but not a critical emergency-patch deployment should be scheduled promptly but does not require emergency procedures.

An operator account provisioned with only operator.approvals scope for approval workflow tasks is created in an OpenClaw deployment. An attacker or malicious internal user with access to this account (or who discovers its credentials) uses it to send HTTP GET requests to /v1/models, enumerating all gateway models and their metadata that should be restricted to accounts with full operator read scope. The attacker gathers intelligence on gateway configurations without triggering WebSocket RPC authorization logs that would catch similar attempts via the stricter RPC channel, enabling reconnaissance for further attacks. No public exploit code has been identified, but the simplicity of HTTP endpoint enumeration means proof-of-concept development is trivial.