CVE-2026-101879CWE-862broken-access-control

CVE-2026-101879

Medium · published October 1, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-01T00:17Z
References (7)
https://github.com/openclaw/openclaw-windows-node/blob/v2026.7.1-2/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1891-L1913 · [email protected]https://github.com/openclaw/openclaw-windows-node/commit/16cb6897941fa7832ce2811e9d550caed9a49b4b · [email protected]https://github.com/openclaw/openclaw-windows-node/commit/31a8c6557df740232898079b21f0eb677a4119cf · [email protected]https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1-3 · [email protected]https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h · [email protected]https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-3-missing-authorization · [email protected]https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 19:16Z
    OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
    cvelistv5