OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, potentially bypassing intended access controls.
OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, potentially bypassing intended access controls.
为什么是这个 VPI(可解释·实验性)
VPI 计算依据
| 影响度 | 60.00 |
| 利用信号(无额外利用信号) | ×1.00 |
| VPI | 60.00 |
VPI 公式 vpi-v1
| 来源 | CVSS 版本 | 基础评分 | 严重程度 | 向量字符串 | 评估日期 |
|---|---|---|---|---|---|
| NVDNIST | 4.0 | 6.0 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | 2026. 06. 17. |
| NVDNIST | 3.1 |
| 7.1 |
HIGH |
| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
| 2026. 06. 17. |