EUVD-2026-87456
GHSA-cq6m-mhgc-vqrg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain non-owner channel sender access
-
DeliveryInvoke diagnostics export command
-
ExploitAuthorization check bypassed
-
ExecutionReceive owner-only host diagnostic bundle
-
ImpactHarvest config/runtime/service intelligence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already be a connected channel sender (non-owner) in OpenClaw before 2026.7.1, and to invoke the diagnostics export command that lacks an owner-only authorization check. Exploitation is limited by needing this sender-level access (PR:L, not fully unauthenticated) and affects only versions prior to 2026.7.1; impact is confined to disclosure of host/configuration/runtime/connected-service diagnostic data - no write, code execution, or availability effect. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, base 7.1) describes a network-reachable, low-complexity, confidentiality-only authorization bypass that requires low privileges (PR:L) - consistent with an already-connected non-owner channel sender rather than a fully unauthenticated attacker. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so this is 'no public exploit identified at time of analysis'; the 7.1 is driven entirely by the VC:H confidentiality impact, with no integrity or availability effect (VI:N/VA:N). This is a real but bounded issue: it leaks owner-only host, configuration, runtime, and connected-service diagnostics to a lower-privileged party, which is valuable for reconnaissance/pre-exploitation but is not itself code execution or data tampering. Net priority is moderate-to-low - genuine authorization flaw and easy to trigger once a channel session exists, but gated behind having sender access and limited to information disclosure. No conflicting signals are present, though the absence of EPSS/KEV/POC means exploitation likelihood is inferred, not measured. |
| Exploit ScenarioDerived | A non-owner participant who can send messages on an OpenClaw channel issues the diagnostics export command, which fails to verify owner-only authorization. The server returns the full host diagnostic bundle - configuration, runtime state, and connected-service details - to the unauthorized sender, handing them reconnaissance data intended solely for the owner. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Information disclosure in OpenClaw before 2026.7.1 allows authenticated non-owner channel senders to retrieve owner-only host diagnostic bundles through the diagnostics export command, exposing host, configuration, runtime, and connected-service details. The flaw is an authorization bypass (CWE-200) that requires low privileges (a connected channel sender) and causes no integrity or availability impact; no public exploit code is identified at time of analysis.
RemediationAI
Upgrade to OpenClaw 2026.7.1 or a later release, which is the vendor-released patch that enforces owner-only access to the diagnostics export command. If immediate upgrade is not possible, restrict or disable the diagnostics export command for non-owner channel senders and review channel membership to remove untrusted senders; be aware that disabling diagnostics may limit troubleshooting capabilities. Apply least privilege to channel roles and monitor for diagnostic bundle requests from non-owner accounts. Consult the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-4hwv-rj92-h7rp and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-diagnostics for additional details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a platform that organizes interactions into channels with owner and non-owner roles, and it exposes a diagnostics export command intended to produce bundles containing host, configuration, runtime, and connected-service information for owner troubleshooting. The vulnerability is a missing or insufficient authorization check (CWE-200) on that command: instead of enforcing owner-only access, the command permits any connected non-owner channel sender to request and receive the diagnostic bundle. The affected product CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, covering releases before 2026.7.1. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (base 7.1) matches an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, confirming a network-reachable, low-complexity, confidentiality-only flaw that does not enable writes, code execution, or denial of service.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable command abusable by any low-privileged non-owner sender (PR:L), no user interaction, and confidentiality-only impact so I:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about the host, configuration, runtime, and connected services intended only for owners.
Technical POC Analysis
Bug class: broken/missing authorization leading to information disclosure.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenClaw deployments running versions prior to 2026.7.1 can leak sensitive host diagnostic bundles - including host, configuration, runtime, and connected-service details - to low-privileged channel participants who should only ever see owner-level information. Because no vendor patch is currently available, every OpenClaw instance older than 2026.7.1 remains exposed until mitigations are applied, and the exposed data is exactly the kind of environment detail attackers use to map infrastructure and plan follow-on access. Leadership should care because this is a confidentiality exposure affecting connected channels and third parties, not just internal staff, with potential downstream regulatory and partner-notification implications.
No vendor-released patch identified at time of analysis (the advisory's version boundary indicates OpenClaw 2026.7.1 as the remediated release; confirm availability with the vendor). Interim mitigations: restrict connected channels to trusted participants and remove non-owner sender privileges where owner-only diagnostic access is not required; disable, block-list, or policy-gate the diagnostics export command for non-owner senders; segment affected OpenClaw hosts from sensitive internal networks and connected services; enable and monitor audit logging for diagnostics export invocations, alerting on any non-owner request; rotate credentials, tokens, and service keys potentially disclosed via host, configuration, runtime, or connected-service details; and apply least-privilege role assignments across all channel integrations. Exploitation status: no public exploit identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB