CyberRota Analysis
AI-GeneratedThe OpenClaw npm package prior to version 2026.7.1 lacks proper enforcement of administrator scope for browser control accessed via the node.invoke method, potentially allowing unauthorized write-scoped callers to interact with browser-visible applications. This vulnerability can lead to unauthorized inspection and manipulation of browser sessions, depending on the user's profile and authentication state. Organizations utilizing OpenClaw in Gateway deployments should prioritize this update to mitigate the risk of unauthorized access and ensure compliance with security policies.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deployments that honor caller identity and narrower operator scopes, a write-scoped caller with access to a connected browser-capable node can inspect pages, navigate tabs, or interact with browser-visible applications without the configured admin requirement; practical impact depends on the browser profile and signed-in state. Shared-secret token and password callers are considered fully trusted operators under OpenClaw's security model and are not affected. The issue is fixed in 2026.7.1.