OpenClaw EUVD-2026-87461

Requires an OpenClaw Gateway (before 2026.7.1) bridged to an external channel where the attacker holds command access but is NOT the owner - the /voice set command fails to restrict configuration changes to owners. No user interaction or additional authentication beyond the existing command-access foothold is needed (PR:L, UI:N). Exploitation is limited to changing the voice used by Talk responses for the already-configured provider; it does not expose credentials, grant host capabilities, or affect availability, so the practical prerequisite is that the deployment uses external-channel command access and a Talk/voice provider is configured.

This is a genuinely low-priority issue whose vendor CVSS 4.0 base of 5.3 already reflects its limited impact. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) shows network-reachable, low-complexity exploitation, but the only impact metric set is VI:L - integrity-limited, with VC:N (no confidentiality loss), VA:N (no availability loss), and no subsequent-system impact (SC/SI/SA:N). The description confirms this scoping: attackers can only change the voice used by Talk responses for the configured provider, explicitly 'without exposing credentials or granting additional host capabilities.' No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' PR:L is correct because the attacker must already have command access on an external channel - this is an authorization scope-widening flaw (CWE-863) where a non-owner sender reaches an owner-only configuration command, not an unauthenticated break-in. Signals are internally consistent: low base score, integrity-only impact, and a narrow precondition all point to a nuisance-grade configuration-tampering bug rather than a security-critical vulnerability. There are no conflicting signals to reconcile.

An attacker who already has command access as a non-owner sender on an external channel bridged to an OpenClaw Gateway issues the /voice set command, which fails to enforce owner-only authorization. This persists a changed voice configuration for the configured Talk provider, altering how the agent's spoken responses sound. No public exploit code is identified, and the impact is confined to configuration integrity - no credential disclosure or host access results.