OpenClaw EUVD-2026-87466

Requires the OpenClaw MCP channel bridge to be in use for Claude Code permission prompts, AND the attacker to already be an authorized non-owner channel sender holding channel command access - not an anonymous remote attacker. Exploitation further depends on a permission request being pending for the owner at the time (the action's severity is bounded by whatever host capabilities that specific Claude Code run requested). Limiting factors: pre-existing authorized channel membership with command privileges (PR:L), the passive dependency on a pending owner request (UI:P), and affected versions strictly before 2026.7.1.

This is an authorization flaw (CWE-862, Missing Authorization) in the npm package openclaw before 2026.7.1: the MCP channel bridge does not enforce the owner-only requirement on Claude Code permission prompts, letting an already-authorized non-owner channel sender approve/deny requests meant for the owner. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H) yields 8.6 (High), and I broadly agree on network vector, low complexity and low-privilege prerequisite, though the VC/VI/VA:H rating is optimistic - the description explicitly says impact 'depends on the pending action and the host capabilities requested,' so worst-case (arbitrary host command/file operations) is possible but not guaranteed. Critically, exploitation is NOT unauthenticated: it requires an attacker who is already an authorized channel sender WITH channel command access (PR:L), and it depends on a pending owner permission request existing at the time - a meaningful gating condition (reflected as UI:P in 4.0). No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so there is no evidence of active exploitation; this reads as an insider/over-privileged-collaborator escalation rather than a mass-exploitable remote bug. Combined with the niche footprint of the product, this is a legitimate but relatively contained issue - patch on normal cadence rather than emergency priority.

An OpenClaw deployment bridges Claude Code permission prompts through a shared MCP channel (e.g. a chat/team channel). A non-owner member who has channel command access waits for or observes a pending permission request intended for the owner and approves it themselves, causing the requested host action (file write, command execution, etc.) to proceed without the owner's consent. No public proof-of-concept is identified in the provided data.