Is there a patch available for EUVD-2026-37149?

Yes, a patch is available for EUVD-2026-37149. Update the affected software to the latest version immediately.

OpenClaw EUVD-2026-37149

Q: What is the CVSS score of EUVD-2026-37149?

EUVD-2026-37149 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-53847 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-06-16 VulnCheck

GHSA-58wc-8wrv-xp9j

GHSA-x629-46cc-7xgw

Privilege Escalation Openclaw

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Requires valid operator.write credentials over the network (AV:N, PR:L); privilege escalation stays within the product boundary (S:U); configuration modification yields limited integrity and availability impact with no confidentiality exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 19:05 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.6.

DescriptionCVE.org

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficient scope validation to apply unauthorized configuration changes beyond the intended write scope.

AnalysisAI

Privilege escalation in OpenClaw before 2026.5.6 allows authenticated Gateway operators holding operator.write access to modify global configuration that should be restricted exclusively to operator.admin privileges. The root cause (CWE-266: Incorrect Privilege Assignment) lies in insufficient scope validation within the Active Memory write scope, which fails to enforce the boundary between the write and admin privilege tiers. No public exploit has been identified at time of analysis; however, the network-accessible attack vector (AV:N, PR:L) means any authenticated operator-level account across the deployment is a viable exploitation path with low attack complexity.

Technical ContextAI

OpenClaw is a Gateway product (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) that implements a tiered role-based access control model with at least two distinct operator privilege levels: operator.write and operator.admin. The vulnerability resides in the Active Memory write scope - a component responsible for handling runtime configuration write operations. CWE-266 (Incorrect Privilege Assignment) identifies the root cause as the scope validation logic failing to enforce the privilege boundary: operations that should require operator.admin are accepted when presented by an operator.write token. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the flaw is reachable over the network by low-privileged authenticated users without special attack prerequisites or required user interaction.

RemediationAI

Vendor-released patch: OpenClaw 2026.5.6, which resolves the insufficient scope validation in the Active Memory write scope per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-x629-46cc-7xgw. Upgrade to 2026.5.6 or later as the primary remediation step. If an immediate upgrade is not feasible, restrict operator.write access to the same vetted personnel population as operator.admin, treating write-scope credentials as effectively equivalent to admin credentials until patched - this trade-off reduces operational flexibility but closes the privilege escalation path. Additionally, audit all existing accounts holding operator.write access, review recent gateway configuration changes for unauthorized modifications, and where architecturally possible, restrict network access to the Gateway management interface to trusted hosts to reduce the AV:N attack surface.