EUVD-2026-87494
GHSA-8hvw-855c-9wjw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain admitted membership in monitored WhatsApp group
-
DeliveryIssue /new <model> despite command denial
-
ExploitReset shared group session with override
-
ExecutionPersist operator-permitted provider/model
-
ImpactAlter routing, cost, or data flow for all members
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an OpenClaw deployment (>=2026.5.2, <2026.8.1) bridging a WhatsApp group, where the attacker is a group sender admitted for ordinary messages but denied by commands.allowFrom or owner command authorization. The attacker exploits it by sending /new <model> to reset the shared group session. Limiting factors: the attacker must already be an accepted group participant (PR:L); the override is confined to providers/models the operator has ALREADY permitted - no new provider can be added and no host command execution is possible; impact is limited to changing provider routing, cost, data flow, or availability for the shared session. |
| Impact | This is a genuine but low-severity authorization flaw, not a high-CVSS-but-hollow issue - the vendor's own CVSS 4.0 score of 5.3 (medium) is honest rather than inflated, and it aligns with my independent assessment (~5.4 in CVSS 3.1 terms). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network reach with low complexity and no user interaction, but requires PR:L: the attacker must already be a group participant admitted for ordinary messages. Crucially, all three impact metrics are Low (VC:L/VI:L/VA:L) because the flaw only lets a command-denied member issue /new <model> to reset the shared group session and pin a provider/model already permitted by the operator - it explicitly does NOT allow adding a new provider or any host command execution. There is no EPSS score, no CISA KEV listing, and no public POC, so exploitation is unproven. The correct exploitation-status phrase is: no public exploit identified at time of analysis. The signals are internally consistent - modest CVSS, no exploitation evidence, tightly-bounded impact - so this is a low real-world priority best handled by routine patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker who has been admitted to a WhatsApp group that an OpenClaw agent monitors, but who is denied command privileges via commands.allowFrom or owner-command authorization, sends the /new <model> command. This resets the shared group session and persists a provider/model override chosen from those the operator already permits, altering provider routing, cost, or data-flow for every subsequent turn in that shared session. No public exploit code exists and the technique requires no special tooling - just group membership and knowledge of the command. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Incorrect authorization in OpenClaw (npm package openclaw) versions 2026.5.2 through 2026.8.0 lets a WhatsApp group sender who is admitted for ordinary messages but denied command access by commands.allowFrom or owner command authorization send the /new <model> command to reset the shared group session and persist a provider/model override for that session. The flaw is an authenticated (PR:L in the CVSS vector) CWE-863 authorization error, scored 5.3 medium under CVSS 4.0 and consistent with the independent CVSS 3.1 assessment of ~5.4; because the override is restricted to providers and models the operator has already permitted, the attacker cannot add a new provider or gain host command execution, and impact is limited to changed provider routing, cost, data flow, or availability in the shared group session. No public exploit identified at time of analysis; the vendor-released fix is version 2026.8.1.
RemediationAI
Upgrade OpenClaw to version 2026.8.1, the vendor-released patch that closes the gap between message admission and command authorization; this is the only complete fix and should be applied to every deployment that bridges a WhatsApp group. Until the upgrade can be scheduled, the most effective compensating control is to stop treating group membership as implicitly trusted for session-mutating commands: remove or exclude users who must not hold command privileges from any WhatsApp group bridged into OpenClaw, accepting the operational cost of tighter group administration, or disable WhatsApp group bridging entirely for groups that mix trusted and untrusted senders, at the cost of losing shared-session functionality for those groups. A second, narrower mitigation is to shrink the set of operator-permitted providers and models to those whose cost, routing, and data-flow characteristics are acceptable if any group member selects them, since the flaw only permits choosing from the already-permitted list; the trade-off is reduced model flexibility for legitimate users. Reviewing logs for /new <model> invocations originating from senders outside commands.allowFrom helps detect prior abuse of this behavior. Note that no public exploit code and no confirmed active exploitation were identified at time of analysis, so prioritization can be driven by the medium severity and the exposure of the WhatsApp bridging configuration rather than by an exploitation emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a Node.js npm package (CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) that bridges chat platforms such as WhatsApp into an agentic assistant, maintaining shared session state per group. The vulnerability is rooted in CWE-863 (Incorrect Authorization): the message-admission check and the command-authorization check (commands.allowFrom and owner command authorization) are enforced inconsistently, so a sender who passes the ordinary-message gate but fails the command gate can still reach the /new <model> command handler. That handler resets the shared group session and writes a provider/model override into persistent session state, meaning the effect outlasts the single offending message and governs subsequent turns. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with low VC/VI/VA and no subsequent-system impact (SC:N/SI:N/SA:N) confirms the boundary: a low-privileged, already-connected group member can alter session configuration, but the blast radius is capped because selection is confined to providers and models the operator already enabled - no new provider registration, no credential or host-level command execution. Practical consequences are contractual and operational rather than confidentiality-catastrophic: traffic may be routed to a different (perhaps more expensive or less desirable) inference backend, cost accounting may be skewed, data may flow to an unintended provider, and the shared session may be disrupted for other group members.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Attacker must be an admitted group member (PR:L) but no UI or complexity; impact is bounded to provider/model routing changes, so C/I/A all Low and scope Unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorization can issue the /new <model> command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session, potentially changing provider routing, cost, data flow, or availability. It does not allow adding a new provider or host command execution. The issue is fixed in version 2026.8.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB