EUVD-2026-87518
GHSA-wh2c-24c2-x93p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain admitted non-owner channel access
-
DeliverySteer agent to WhatsApp login tool
-
ExploitOwner-only boundary not enforced
-
ExecutionForce login and receive new QR
-
ImpactGateway WhatsApp account disconnected (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the @openclaw/whatsapp plugin (before 2026.8.1) with a WhatsApp account configured on the Gateway AND a non-owner sender who has already been admitted to a channel and can steer the agent to invoke the generic channel-tool path. The forced-login DoS (disconnecting the account) is achievable once those conditions hold; the more severe full account relinking/takeover additionally requires the attacker to scan the returned QR code with a separate phone - an out-of-band manual step that limits the integrity impact. The flaw does not bypass WhatsApp's own transport authentication. |
| Impact | This is a genuine but moderate-severity issue whose real-world risk is gated by deployment context rather than raw exploitability. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) suggests easy network-reachable exploitation, and the primary reliable impact is availability (VA:H): an admitted non-owner sender who can steer the tool forces a WhatsApp re-login, generating a new QR and disconnecting the Gateway's WhatsApp account. The VI:H (high integrity) rating is generous - full account relinking/takeover ADDITIONALLY requires the attacker to physically scan the returned QR code with a separate phone, an out-of-band step that materially lowers the odds of the integrity impact versus the guaranteed denial-of-service. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or automated exploitation. Net: this is a real, patch-worthy authorization flaw for anyone running the @openclaw/whatsapp plugin with multi-user channel access, but it is not a widespread emergency - it is niche-product, requires an already-admitted (though non-owner) sender, and the most severe outcome depends on a manual attacker action. |
| Exploit ScenarioDerived | An OpenClaw Gateway is configured to bridge a WhatsApp account and admits non-owner users into a channel. A non-owner participant steers the agent to invoke the WhatsApp login tool, which (missing the owner-only check) issues a forced login and returns a fresh QR code, immediately disconnecting the legitimate WhatsApp account and denying service. No public exploit code is known; if the attacker also scans the returned QR with their own phone, they can relink and hijack the account entirely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Authenticated non-owner senders can abuse the generic channel-tool path in the @openclaw/whatsapp plugin (npm, versions before 2026.8.1) to force a WhatsApp login for a configured Gateway account, issuing a fresh QR code that disconnects the existing session and causes loss of availability; integrity impact is limited because full account relinking still requires the attacker to physically scan the returned QR code with another phone. The flaw is a missing authorization check on an owner-only tool boundary (CWE-862) rather than a bypass of WhatsApp transport authentication, and it requires PR:L - an attacker who has already been admitted to a channel and can steer the agent. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 2026.8.1.
RemediationAI
The primary fix is to upgrade @openclaw/whatsapp to 2026.8.1 or later, which corrects the owner-status propagation on the generic channel-tool path; see the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq for release details (no separate backport or tagged patch version below 2026.8.1 is identified in the available data). Where immediate upgrade is not possible, the practical compensating control is to reduce the attacker prerequisite rather than rely on detection: restrict channel admission so that only trusted, owner-verified senders can reach the agent, which removes the non-owner sender required by the assessed vector at the cost of narrowing legitimate multi-user channel use. Administrators can additionally avoid exposing the login-capable tool to non-owner senders - for example by limiting which channel tools the agent is permitted to invoke and constraining the agent's tool allowlist - accepting that this may break intended workflow automation. Because the resulting QR code must be scanned out-of-band, monitoring the Gateway for unexpected forced-login events or QR regenerations and promptly re-linking or rotating the WhatsApp account provides a useful detection and containment layer; if a forced login is observed, treat the exposure as an availability incident and re-link the account from a trusted device, but assume no credential compromise of WhatsApp itself, since transport authentication is not bypassed. There is no vendor-released patch identified below 2026.8.1, and patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is @openclaw/whatsapp, a Node.js/npm plugin that bridges an OpenClaw Gateway agent to a WhatsApp account. The plugin exposes an owner-only login tool, but the generic channel-tool invocation path forwards requests without preserving the originating sender's owner status, so the authorization decision that should gate owner-only tools is never enforced (CWE-862, Missing Authorization). Because the boundary being bypassed is the plugin's own tool authorization layer and not WhatsApp's transport authentication, an attacker who has already been admitted to a channel can invoke the login tool as if authorized, triggering a forced login that returns a new QR code for the configured account. Two outcomes follow: the existing Gateway-to-WhatsApp session is torn down (availability loss, reliably achieved), and full account relinking is theoretically possible but requires the attacker to complete an out-of-band step by scanning the returned QR code with a separate phone, which caps the integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) is consistent with a low-privileged, network-reachable attacker whose realistic outcome is high availability impact and limited integrity gain; the CVSS 4.0 score supplied with the record is 7.2 with VC:N/VI:H/VA:H and the same AT:N/PR:L/UI:N prerequisites. The affected CPE is cpe:2.3:a:openclaw:whatsapp:*:*:*:*:*:*:*:* with an EUVD-flagged range of whatsapp 0 through versions below 2026.8.1. The issue is tracked as EUVD-2026-87518 and was reported by VulnCheck.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
PR:L for the required admitted non-owner sender; A:H for reliable account disconnection; I:L (not I:H) because full takeover needs an out-of-band QR scan; C:N as no data is disclosed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and causing loss of availability; full account relinking additionally requires the attacker to scan the returned QR code with another phone. The issue affects the owner-only tool boundary rather than WhatsApp transport authentication. Fixed in 2026.8.1.
Articles & Coverage 1
Technical POC Analysis
Missing authorization (CWE-862) at the owner-only tool boundary in the npm package @openclaw/whatsapp.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The @openclaw/whatsapp npm plugin, at versions below 2026.8.1, allows an authenticated participant already admitted to a channel to kick a configured Gateway WhatsApp account offline and force a fresh QR-code login. The practical business effect is loss of availability for any WhatsApp-based customer-service, notification, or operational messaging channel routed through the affected Gateway account, while data-compromise risk remains limited because a full account relink still requires physically scanning the returned QR code. Leadership should treat this as an operational-continuity issue for teams relying on WhatsApp through this plugin, especially since restoring service typically requires a device owner to physically relink the account.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB