EUVD-2026-36612
GHSA-8rhr-7x4c-49j6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the timing-window precondition (maps to CVSS 4.0 AT:P); PR:L because a previously valid token is required; no confidentiality or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Blast Radius
ecosystem impact- 2 npm packages depend on openclaw (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.24.
DescriptionCVE.org
OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration.
AnalysisAI
OpenClaw before version 2026.4.24 permits users whose slash command tokens have been explicitly revoked to continue issuing slash commands during the active monitor refresh window, violating the expected access boundary. The flaw stems from a revocation propagation lag: the token invalidation state is not synchronously enforced but instead depends on a periodic monitor cycle, allowing a briefly stale authorization check to pass. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact depends heavily on the duration of the monitor refresh interval and the sensitivity of slash commands exposed by the operator.
Technical ContextAI
CWE-613 (Insufficient Session Expiration) describes the root cause: token revocation is not applied atomically or synchronously, leaving a window during which previously valid credentials continue to be accepted. In OpenClaw's architecture, a monitor process periodically refreshes token state rather than invalidating it in real time at the point of revocation. This creates a race condition bounded by the monitor's polling interval. The affected CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, covering all versions prior to 2026.4.24. The VulnCheck advisory slug references Mattermost context ('mattermost-slash-token-revocation-lag-via-monitor-refresh-delay'), strongly suggesting OpenClaw operates as a slash command integration layer for Mattermost, and the 'Microsoft' intelligence tag may indicate additional integrations with Microsoft collaboration platforms (e.g., Teams). The CVSS 4.0 vector's AT:P (Attack Requirements: Present) metric formalizes the timing precondition inherent to this class of revocation-lag vulnerability.
RemediationAI
The primary fix is upgrading OpenClaw to version 2026.4.24 or later, which addresses the token revocation lag per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-4m3v-q747-pc6h. If immediate upgrading is not possible, operators should reduce the monitor refresh interval to the shortest operationally feasible value, directly shrinking the exploitation window at the cost of increased monitor polling overhead. Additionally, restricting the scope of slash commands exposed through OpenClaw to non-destructive or read-only operations limits the integrity impact achievable within the window - the trade-off being reduced functionality. Revocation events for high-privilege tokens should be followed by manual verification that the token is no longer accepted before considering the revocation complete under the pre-patch configuration. Operators running OpenClaw in Mattermost or Microsoft platform contexts should consult those platforms' own audit logging to detect any post-revocation slash command invocations.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today