OpenClaw EUVD-2026-26134

Exploitation requires that the attacker's node was PREVIOUSLY paired with the target OpenClaw instance and then reconnects - this stale pairing is the exact trigger, corresponding to CVSS 4.0 AT:P (attack requirement present) and PR:L (the paired node already holds some low-privilege scope). The attack vector is local (AV:L), so the attacker needs local reach to the assistant's pairing/reconnect channel on the host, not remote internet access. What limits exploitation: an attacker with no prior pairing cannot bypass initial pairing this way; the flaw only elevates scope for nodes already known to the system, and OpenClaw's trust model is a single-user local assistant with no multi-tenant boundary, so it is not remotely reachable in a default deployment. No user interaction is required (UI:N).

Signals are mixed and point to a genuine-but-narrow risk. The published CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N, VC:H/VI:H/VA:H, score 7.3 High) indicates local vector, low attacker privileges, an attack requirement present (AT:P - the attacker must be a previously paired node), and total technical impact - matching CISA SSVC's Technical Impact: Total. However, SSVC also records Exploitation: none and Automatable: no, and EPSS is only 0.02% (6th percentile), so widespread or automated exploitation is not expected. It is not KEV-listed and no POC is referenced, so this is not an urgent drop-everything item; the high score is driven by total local impact, not by ease or breadth of exploitation. The AT:P plus local-vector combination is the key limiter: an attacker cannot exploit this from nothing - they must already have been a paired node on the system. Treat as a meaningful local privilege/authorization boundary bug to patch promptly, not an externally-exposed RCE.

An attacker who controls a node that had previously paired with a target OpenClaw instance (for example a returning client or a compromised prior-paired device on the same host) reconnects to the assistant. Because reconnect does not re-enforce the operator.admin scope, the node is granted exec-capable commands and runs privileged operations on the local assistant system. No public POC is referenced, and the local vector plus prior-pairing requirement (CVSS AV:L, AT:P) mean the attacker must already hold that foothold.