OpenClaw EUVD-2026-25328

Exploitation requires possession of a valid write-scoped (operator.write) gateway credential for the target OpenClaw instance. The attacker must have network access to the chat.send endpoint. The /verbose parameter must be reachable via the chat.send path, which is the default behavior in all unpatched versions. Exploitation is limited by the requirement for pre-authenticated write-scope access - unauthenticated external attackers cannot exploit this directly. The impact is further bounded to information disclosure of verbose reasoning or tool output and session state persistence, with no direct availability impact. Deployments that do not issue write-scoped gateway credentials to lower-trust principals, or that run OpenClaw >= 2026.3.28, are not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 Medium, reflecting low-complexity network exploitation requiring only write-scoped credentials, with limited confidentiality and integrity impact. This is broadly consistent with the real-world risk picture: EPSS is 0.05% at the 14th percentile, SSVC assigns exploitation=none, automatable=no, and technical impact=partial. The combination of no KEV listing, no known public exploit, and the requirement for pre-existing write-scoped gateway authentication makes this a low-urgency but legitimate authorization control failure. The primary real-world harm is information disclosure - an operator with write scope could expose verbose reasoning or tool output that administrators intended to restrict - rather than full system compromise. No conflicts between signals are present; all sources consistently characterize this as a medium-severity, low-exploitation-probability flaw. The SSVC automatable=no finding is consistent with the PR:L requirement ruling out unauthenticated mass exploitation.

An operator with a write-scoped gateway credential - a lower-privilege role legitimately issued for automated chat interactions - crafts a chat.send request that includes the /verbose parameter. This causes OpenClaw to persist a verboseLevel session override that would normally require administrator access via sessions.patch, enabling the caller to subsequently receive verbose output containing sensitive reasoning traces or tool invocation details that the deploying organization intended to restrict to administrators.