OpenClaw Windows Node EUVD-2026-90252

Exploitation requires an attacker to be, or to control, a gateway or agent already connected to the OpenClaw Windows Node's node WebSocket interface (hence PR:L, not unauthenticated). Given that access, the attacker invokes the screen.snapshot, camera.snap, or location.get handlers in NodeService, which before version 2026.7.1-3 performed the capture without the one-time consent gate (EnsureRecordingConsentAsync) that screen.record/camera.clip already enforced - and for camera.snap and location.get without even a user-visible indicator. No user interaction is needed (UI:N). Limiting factors: only OpenClaw Windows Node versions before 2026.7.1-3 are affected; the attacker must already possess node-agent/gateway connectivity; and the realistic high-impact path is a compromised or prompt-injected connected agent rather than an anonymous internet attacker. Impact is confined to confidentiality (silent screenshots, webcam photos, geolocation) with no integrity or availability effect.

This is a genuine but moderate-severity privacy vulnerability, not an inflated high-CVSS score. The vendor CVSS 4.0 base is 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), correctly reflecting a network-reachable, low-complexity flaw that requires some privilege (PR:L, i.e. a connected gateway or agent) and impacts confidentiality only - there is no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is 'no public exploit identified at time of analysis.' The real risk is bounded by the PR:L prerequisite: an attacker must already be a gateway/agent authorized to talk to the node WebSocket, or must hijack such an agent (the vendor's own commit comments explicitly cite the 'prompt-injected agent' threat model). No signals conflict: CVSS network vector is consistent with the WebSocket-based description, and the confidentiality-only impact matches the CWE-862 missing-authorization / consent-bypass nature. The most notable metadata problem is the input Tags labeling this a 'Microsoft' product, which is incorrect - OpenClaw is an independent open-source project. Priority is real but limited: treat as a meaningful privacy/surveillance risk for exposed nodes, especially in agentic deployments where a compromised or manipulated agent could silently surveil users, rather than an internet-wide emergency.

An attacker who controls or has prompt-injected a gateway/agent that is already connected to an OpenClaw Windows Node sends screen.snapshot, camera.snap, and location.get messages over the node WebSocket. The node executes these capture handlers with no consent prompt and (for camera and location, pre-patch) no on-screen indicator, silently returning a desktop screenshot, a webcam photo of the user, and the device's geolocation. No public exploit is identified, but the source diff confirms the vulnerable path and the low technical barrier once agent-level access exists.