OpenClaw EUVD-2026-87471

Exploitation requires an actor able to steer a tool-enabled OpenClaw agent into calling the model-facing cron tool, and the target must run OpenClaw before version 2026.7.1. The specific trigger is a mixed-case payload 'kind' value that evades the agent-facing shell-execution guard and later normalizes into a command job. LIMITING FACTORS: the flaw is reachable ONLY through the model-facing cron tool - direct CLI scheduling and authorized Gateway scheduling are trusted operator surfaces and are NOT affected; the agent must be tool-enabled with cron capability; and the attacker gains only the privileges of the OpenClaw process user (not necessarily root). The vector carries PR:L because some ability to influence the agent's tool invocations is prerequisite.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and vendor score of 8.7 (High) describe a network-reachable, low-complexity flaw yielding full confidentiality, integrity, and availability impact with only low privileges and no user interaction - a genuine RCE profile. However, the practical trigger is narrower than the raw vector implies: exploitation requires an actor who can already steer a tool-enabled OpenClaw agent into invoking the model-facing cron tool, so PR:L here effectively means 'access to influence the agent's tool calls,' not classic authenticated network access. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active or automated exploitation - this is a high-severity-by-impact issue rather than a demonstrated widespread-exploitation priority. The input Tag 'Information Disclosure' materially understates the vulnerability: the description and CVSS both indicate full RCE (integrity and availability impact), not a confidentiality-only leak. This is one of a cluster of OpenClaw agent-security advisories (siblings via GHSA-9p6m-2872-xm7x, GHSA-crg9-c62w-j2p5, GHSA-g7fw-3gjp-g5hf), all reported by VulnCheck.

An attacker who can influence a tool-enabled OpenClaw agent (e.g., via prompt injection or a low-trust message channel) instructs it to create a cron job through the model-facing cron tool, supplying a mixed-case payload 'kind' that slips past the shell-execution guard. When the scheduler normalizes the casing, the entry becomes a command job that persistently executes the attacker's chosen commands as the OpenClaw process user. No public exploit code is identified in the provided data, but the attack is low-complexity and requires no user interaction.