Medium severity · published Sep 30, 2026
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OW
OpenClaw Windows Node · OpenClaw
before 2026.7.1-3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101879
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101879
vendor-advisory
https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h
patch
https://github.com/openclaw/openclaw-windows-node/commit/31a8c6557df740232898079b21f0eb677a4119cf
patch
https://github.com/openclaw/openclaw-windows-node/commit/16cb6897941fa7832ce2811e9d550caed9a49b4b
release-notes
https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1-3
technical-description
https://github.com/openclaw/openclaw-windows-node/blob/v2026.7.1-2/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1891-L1913
third-party-advisory
https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-3-missing-authorization
More from OpenClaw Windows Node
8.8
CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
8.8
CVE-2026-101880
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
7.5
CVE-2026-101884
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
6.5
CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 Denial of Service
5.4
CVE-2026-101883
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present