OpenClaw EUVD-2026-87488

Requires the attacker to already possess operator.write-scoped credentials to the OpenClaw Gateway and to reach the sessions.create endpoint over the network; exploitation targets an existing session whose configuration is then altered. What limits it: the write-scope authentication prerequisite (PR:L - not exploitable by fully unauthenticated attackers), the impact ceiling (only session config fields - model, provider, thinking level, auth-profile - can be changed; no code execution or bulk data access), and the requirement that the deployment run OpenClaw before version 2026.8.1. No special non-default feature toggle is described - the flaw is in the endpoint's scope enforcement itself.

This is a genuine but low-priority issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, 5.3 Medium) is internally consistent with the description: a network-reachable authorization bypass requiring existing operator.write credentials (PR:L) with low complexity and no user interaction, yielding only low confidentiality and integrity impact and no availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided - no public exploit identified at time of analysis. The realistic risk is bounded by the PR:L prerequisite (the attacker must already hold write-scoped operator credentials) and by the limited impact: an attacker cannot read arbitrary data or gain code execution, only re-point an existing session's model/provider/auth-profile to bypass admin-reserved controls. There is no signal conflict - network vector and low impact both match the described sessions.create scope-confusion. The CWE-863 (improper authorization) classification is correct and does NOT match the 'Authentication Bypass' tag applied in the input metadata; this is an authorization/scope-escalation flaw, not an authentication bypass. Net: a real defense-in-depth gap worth patching, but not an urgent widescale exploitation risk.

An attacker who already holds operator.write-scoped credentials (e.g. a lower-privileged integration token or a compromised write-scope caller) invokes the sessions.create endpoint against an OpenClaw Gateway and supplies fields - model, provider, thinking level, auth-profile - that should require operator.admin scope. Because the endpoint fails to enforce the admin scope boundary, the attacker rewrites an existing session's configuration to redirect model traffic and sidestep administrative access controls. No public exploit code is identified at time of analysis; the attack is low-complexity but gated on already possessing write-scoped access.