OpenClaw EUVD-2026-87507

Requires (1) an authenticated caller with enough access to retrieve the redacted configuration (e.g. via the config.get operation) on an OpenClaw Gateway before 2026.8.1; (2) a Gateway password with LOW ENTROPY, since the leaked deterministic hashes only serve as useful offline verifiers against guessable passwords; and (3) the remaining, non-redacted configuration values being reconstructable enough to compute candidate hashes. Limiting factors: a high-entropy Gateway password defeats the offline attack even on vulnerable versions; the attacker must already possess low-privilege access to obtain the redacted config; and secret references are explicitly NOT exposed by this flaw. These conditions correspond to the vendor's AC:H/AT:P/PR:L rating.

The vendor (VulnCheck) CVSS 4.0 vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.7 (High), treating the flaw as network-reachable but conditioned on high complexity (AC:H) and a specific attack requirement (AT:P). This is well-aligned with the description: the primitive is an information-disclosure leak (CWE-200), but its severity is driven entirely by DOWNSTREAM impact - recovering the Gateway password grants documented shared-secret operator authority, hence the C/I/A:High rating. The High/attack-requirement complexity is justified because success is gated on TWO conditions the attacker does not control: a low-entropy Gateway password AND remaining configuration values being reconstructable enough to feed the hash verifier. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is not confirmed as actively exploited. Net: this is a real but conditional escalation-of-privilege-via-offline-cracking issue, not a spray-and-pray critical. It should be prioritized where OpenClaw Gateways use weak/guessable operator passwords; strong high-entropy passwords largely defeat the offline verifier even on unpatched versions.

A low-privileged but authenticated caller invokes config.get to obtain the redacted configuration, which unexpectedly embeds deterministic hashes computed over the original unredacted config. Because those hashes function as offline password verifiers, the attacker reconstructs the surrounding config values and brute-forces a low-entropy Gateway password offline - never touching the rate-limited authentication path - and on success wields full shared-secret operator authority. No public proof-of-concept is identified in the available data.