EUVD-2026-25328
GHSA-v3c2-39fm-jq4h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Write-scoped gateway authentication required sets PR:L; network-accessible endpoint is AV:N; limited confidentiality and integrity impact from verbose output exposure and session override persistence with no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.28.
DescriptionCVE.org
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides. Attackers can exploit the /verbose parameter to bypass access controls and expose sensitive reasoning or tool output intended to be restricted to administrators.
AnalysisAI
Privilege escalation in OpenClaw's chat.send gateway endpoint allows write-scoped API callers to bypass authorization controls and persist admin-only verboseLevel session overrides via the /verbose parameter. All OpenClaw npm package versions up to and including 2026.3.24 are affected; the vendor-released fix is version 2026.3.28. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation with only partial technical impact, aligning with an EPSS score in the 14th percentile.
Technical ContextAI
OpenClaw is an npm-distributed AI gateway framework. The vulnerability resides in two source files: src/auto-reply/reply/directive-handling.impl.ts and src/gateway/sessions-patch.ts. The chat.send endpoint accepted the /verbose parameter and propagated it as a persisted session mutation - the same mutation that is correctly gated to administrators when accessed via the sessions.patch API path. CWE-863 (Incorrect Authorization) identifies the root cause: the application performs an authorization check, but it does so inconsistently across two code paths that share the same privileged operation. Write-scoped gateway callers (operator.write permission) are a lower-privilege role than administrators, yet the chat.send path never enforced the admin-only requirement before writing verboseLevel to session state. The CPE string cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covers all platform variants of the package.
RemediationAI
Upgrade OpenClaw to version 2026.3.28 or later, which contains the fix introduced by commit c603123528 (fix(gateway): require admin for persisted verbose defaults). The patched release enforces admin-only authorization on the verboseLevel session persistence path regardless of which API endpoint triggers it. This is the primary and recommended remediation. If an immediate upgrade is not feasible, operators should restrict gateway write-scope credential issuance to trusted, admin-equivalent principals only, accepting the trade-off that this reduces the utility of the write-scope role. Alternatively, network-level controls that restrict access to the chat.send endpoint to known, trusted clients can reduce exposure, though they do not eliminate the authorization flaw. The vendor advisory and fix details are at https://github.com/openclaw/openclaw/security/advisories/GHSA-5h2w-qmfp-ggp6 and the specific fix commit is at https://github.com/openclaw/openclaw/commit/c6031235288a8d3bdf2243bd974340d8c8045bc2.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today