OpenClaw EUVD-2026-26088

Requires authenticated access with operator.write privileges in OpenClaw. The attacker must possess valid operator-tier credentials with write permissions to the chat subsystem - this is NOT a default configuration accessible to anonymous users or read-only operators. Exploitation specifically targets environments where operator accounts are provisioned with write permissions to chat functionality. Limiting factors: requires insider access or prior credential compromise, and the impact is confined to Talk Voice configuration modification (not broader system compromise). Organizations without operator.write accounts provisioned or without the Talk Voice feature enabled face reduced risk.

Real-world risk is moderate despite the CVSS 7.1 score. The CVSS 4.0 vector (AV:N/AC:L/PR:L/VI:H) indicates network-accessible exploitation with low complexity, but requires authenticated operator credentials with write permissions - a significant barrier limiting the attack surface to insider threats or compromised operator accounts. The High Integrity impact (VI:H) reflects the ability to modify sensitive voice configuration, but Confidentiality is only Low (VC:L) and Availability is None (VA:N), meaning this is primarily a configuration tampering issue rather than data theft or denial-of-service. No CISA KEV listing and no public exploit code suggest this is not being actively weaponized in the wild. The vulnerability's real risk depends heavily on deployment context: organizations with many operator-tier accounts face higher exposure than those with strict operator credential management. Patch is available and straightforward (single commit), making remediation achievable. This is a genuine privilege escalation requiring immediate patching, but not an emergency-tier threat comparable to unauthenticated remote code execution.

An attacker with compromised or insider-obtained operator credentials (operator.write privilege level) authenticates to the OpenClaw platform and sends crafted requests to the chat.send endpoint. By manipulating request parameters, the attacker bypasses intended authorization boundaries and gains write access to admin-class Talk Voice configuration persistence. The attacker modifies voice settings to redirect communications, disable security features in the voice subsystem, or alter configuration to facilitate further attacks. No public POC exists, but exploitation complexity is low given the straightforward API abuse vector.