OpenClaw EUVD-2026-87515

Requires a deployment where BOTH session-memory capture and the background 'dreaming' agent feature are enabled, and where the dreaming agent is provisioned with broader file/command capabilities than the originating turn. The attacker must be an admitted-but-restricted external sender (PR:L) whose limited-tool messages are accepted. Beyond configuration, the attacker-supplied text must be captured into session memory, subsequently selected for later processing, and then actually followed by the model - a multi-step, non-deterministic chain (reflected in AC:H/AT:P). These layered, largely non-default preconditions and the dependence on the model choosing to act on the persisted content substantially limit realistic exploitation. No user interaction by a victim operator is required (UI:N).

This is a genuine but conditionally-gated privilege-escalation flaw, not an inflated high-CVSS score. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H, 7.7) is internally consistent with the description: exploitation is remote and needs low privilege (a restricted external sender admitted with limited tools, PR:L), but carries high attack complexity (AC:H) plus an explicit attack requirement (AT:P) because several independent conditions must line up - session-memory capture AND dreaming must be enabled, the malicious text must be captured, then selected for later processing, then actually followed by the broader-privileged background agent. There is NO signal of real-world exploitation urgency: no CISA KEV listing, no EPSS probability supplied, and no public proof-of-concept identified. So while the technical impact is high (a low-authority sender indirectly drives file/command/service actions at the dreaming agent's broader authority - effectively authorization boundary bypass, CWE-863), the practical exploitation probability is low due to the multi-step non-default preconditions. Priority is MEDIUM: treat as a real deferred-injection privilege-escalation issue worth patching, but not an emergency. One data note: the input Tag 'Authentication Bypass' conflicts with the actual mechanism - this is an authorization/provenance-loss privilege escalation (CWE-863), not authentication bypass.

An attacker permitted to message an OpenClaw agent only with a restricted, limited-tool role sends text crafted to read as instructions. That text is persisted to session memory and later, when the unattended 'dreaming' background agent (which holds broad file and command capabilities) processes it, the agent follows the embedded instructions and performs file, command, or service actions the original sender was never authorized to invoke. No public exploit code is identified at time of analysis, and success depends on the content being captured, selected, and followed.