EUVD-2026-87463
GHSA-234j-jv97-3432
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain write-scoped Gateway credentials
-
DeliveryReach connected browser-capable node
-
ExploitCall browser control via node.invoke
-
ExecutionBypass missing admin scope check
-
ImpactInspect signed-in pages and interact with apps
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an OpenClaw Gateway deployment configured to honor caller identity and narrower operator scopes (not the shared-secret token or password trusted-operator model, which is unaffected). The attacker must already possess a valid write-scoped (low-privilege) caller credential AND have access to a connected browser-capable node. Exploitation uses the node.invoke code path specifically, because direct browser.request access correctly enforces admin scope. Realized impact is further limited by the target browser profile and its signed-in state; no user interaction is required. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L, base 8.7 'High') describes a network-reachable, low-complexity authorization bypass requiring only a low-privilege (write-scoped) authenticated caller. There is no CISA KEV listing, no EPSS score supplied, and no public exploit code identified in the provided intelligence, so this is a real but not urgent priority: exploitability is gated by prerequisites rather than mass-scannable. The CWE-863 (Improper Authorization) classification matches the description far better than the 'Authentication Bypass' tag - this is a scope/permission-enforcement gap, not an authentication failure. The high VI:H is somewhat generous given the description caveats impact to 'inspect pages, navigate tabs, or interact with browser-visible applications' and explicitly states 'practical impact depends on the browser profile and signed-in state'; confidentiality (reading a signed-in browser session) is the strongest impact, while integrity is more limited. Importantly, exploitation only matters in Gateway deployments that honor caller identity and narrower operator scopes; shared-secret token and password callers are trusted operators and are unaffected, which materially narrows the real-world exposed population. |
| Exploit ScenarioDerived | In a multi-operator OpenClaw Gateway deployment, an attacker holding only a write-scoped (non-admin) token but with access to a connected browser-capable node invokes browser control through the node.invoke method, which fails to enforce the admin scope that direct browser.request calls require. They then drive the browser to read pages from a signed-in profile or interact with browser-visible internal applications. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Authorization bypass in OpenClaw (npm package 'openclaw') before 2026.7.1 lets a low-privilege, write-scoped caller reach browser-control functionality through the node.invoke code path even though the equivalent direct browser.request path correctly enforces administrator scope. The issue only affects Gateway deployments that honor caller identity and narrower operator scopes, and it requires the attacker to already hold a valid write-scoped credential plus access to a connected browser-capable node; deployments using OpenClaw's shared-secret token or password trusted-operator model are not affected. A successful exploit allows the caller to inspect pages, navigate tabs, and interact with browser-visible applications without the configured admin requirement, with realized impact bounded by the target browser profile and its signed-in state; no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Upgrade the 'openclaw' npm package to 2026.7.1 or later, which the vendor confirms fixes the node.invoke authorization gap and restores the administrator scope requirement on browser control; advisory details are at GHSA-jghr-xp78-995p (https://github.com/openclaw/openclaw/security/advisories/GHSA-jghr-xp78-995p). Where an immediate upgrade is not possible, the most direct compensating control is to withhold write-scoped operator credentials from any Gateway deployment that also has browser-capable nodes attached, since exploitation requires both a low-privilege caller credential and reachable browser control - the trade-off is that legitimate write-scoped automation loses access until remediation is applied. Alternatively, disconnect or segregate browser-capable nodes from Gateways that serve narrow-scope callers, accepting the operational cost of reduced browser automation coverage. Switching affected Gateways to the shared-secret token or password trusted-operator model removes the vulnerability by collapsing all callers into the trusted tier, but this sacrifices per-operator identity and least-privilege auditing and should be treated as a temporary measure. Because exploitation is silent from the Gateway's perspective, audit Gateway logs for node.invoke calls issued by write-scoped callers that resulted in browser page inspection or tab navigation, and consider rotating credentials for any write-scoped operators that had access to browser-capable nodes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a Node.js-based browser/agent control platform whose Gateway exposes an operator API with scoped callers and a separate node.invoke method for dispatching commands to connected nodes. The vulnerability is an instance of CWE-863 (Incorrect Authorization): the authorization check for administrator scope is implemented on the direct browser.request entry point but is not enforced on the alternate node.invoke path that can reach the same browser-control capability, creating a second, less-guarded route to a privileged function. The affected component is the authorization middleware/scoping logic of the Gateway, which is why the failure is conditional on a deployment configured to honor caller identity and narrower operator scopes; environments that treat shared-secret tokens or passwords as fully trusted operators collapse all callers to the same trust level and therefore bypass the flaw by design. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, 8.7 High) and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) agree that the bypass is network-reachable, low-complexity, requires only a low-privilege authenticated caller, and needs no user interaction, while the assessed integrity impact is tempered by the dependency on the victim browser's profile and signed-in state.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Write-scoped authenticated caller gives PR:L over the network with no UI; reading signed-in browser pages is C:H, interaction is limited (I:L), no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deployments that honor caller identity and narrower operator scopes, a write-scoped caller with access to a connected browser-capable node can inspect pages, navigate tabs, or interact with browser-visible applications without the configured admin requirement; practical impact depends on the browser profile and signed-in state. Shared-secret token and password callers are considered fully trusted operators under OpenClaw's security model and are not affected. The issue is fixed in 2026.7.1.
Articles & Coverage 1
Technical POC Analysis
Evidence base: GitHub advisory GHSA-jghr-xp78-995p ("Browser proxy could miss its admin scope") only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenClaw (npm package 'openclaw') versions before 2026.7.1 contain an authorization bypass that lets a low-privilege, write-scoped caller reach browser-control functionality-such as inspecting pages and interacting with browser-visible applications-without the configured administrator scope. This affects Gateway deployments that honor caller identity and narrower operator scopes, requiring a valid write-scoped credential and access to a connected browser-capable node; shared-secret token or password trusted-operator deployments are not affected. No public exploit identified at time of analysis, but leadership should prioritize remediation because a successful exploit could expose sensitive browser sessions and signed-in applications.
No vendor-released patch identified at time of analysis; interim mitigations include using the shared-secret token or password trusted-operator model (not affected), restricting write-scoped credentials, and limiting access to connected browser-capable nodes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB