OpenClaw EUVD-2026-87483

Requires that OpenClaw (before 2026.8.1) has operator-authored command cron jobs configured without proper owner binding, and that the attacker can act as a model-visible agent caller - i.e. supply input the agent processes with at least low-level access. Given those, the caller can inspect the jobs' stored environment variables and force-run disabled or unscheduled command jobs. Limiting factors: the target deployment must actually use command cron jobs (no jobs configured means no exposure), and the attacker must already reach the agent's caller surface; the disclosed secrets and executable commands are only those the operator placed in those jobs.

The vendor CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) describes a network-reachable, low-complexity flaw requiring only low privilege - consistent with the description's 'model-visible agent caller,' i.e. any caller whose input the agent processes, not a full operator. The dual VC:H/VI:H impact is well-justified: the flaw both discloses stored secrets (environment variables) and lets the caller force-execute operator-authored command jobs, which is effectively arbitrary command execution bounded by whatever those cron jobs contain. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This tempers what the high base score implies: it is a genuinely serious authorization/exposure bug within OpenClaw deployments, but real-world risk is gated by OpenClaw's niche footprint and by the attacker first needing a foothold as an agent-visible caller. Note the CWE-200 (Information Disclosure) classification and 'Information Disclosure' tag understate the impact - the ability to force-run command jobs is an integrity/execution issue (reflected in VI:H), not merely disclosure.

An attacker who can supply input to an OpenClaw agent (a model-visible caller with only low privilege) enumerates operator command cron jobs that have no owner binding, reads their stored environment variables to harvest secrets, then force-runs a disabled or unscheduled command job to execute the operator's commands on the host. No public POC is identified at time of analysis, but the low attack complexity and lack of a real ownership check make exploitation straightforward once caller access is obtained.