CVE-2026-19007: broken privilege check on elevated

CISO Take

This vulnerability lives in the isApprovedElevatedSender function of openclaw-cn, an AI auto-reply agent, and stems from improper privilege management (CWE-266/CWE-269) that lets a remote attacker have their messages treated as coming from an approved elevated (trusted/admin) sender. Because the flaw sits in a network-reachable authorization check requiring only low privileges and no user interaction (AV:N/AC:L/PR:L/UI:N), an attacker with minimal access to the bot's messaging channel could trigger privileged auto-reply behavior meant only for trusted senders. VulDB has published the technical details and the issue is flagged as publicly disclosed, and while EPSS sits at the 89th percentile it's still a low absolute score (0.2%), it's not in CISA KEV, and no working exploit tool or Nuclei template exists yet, so mass exploitation is unlikely though targeted abuse is plausible. The maintainer was notified via GitHub issue #564 and has not responded, meaning there is no official patch. Until upstream fixes it, disable or restrict elevated-sender auto-reply commands, enforce sender authorization at an independent gateway layer rather than trusting the bot's internal check, and monitor logs for elevated actions triggered by unexpected senders.

Sources: NVD EPSS ATLAS vuldb.com

What is the risk?

Medium severity (CVSS 6.3) but the risk profile skews toward 'targeted, low-noise' exploitation rather than mass scanning: attack complexity is low and no user interaction is required, but the attacker needs some baseline reachability to the bot's messaging surface (PR:L) and specific knowledge of the elevated-sender workflow. The absence of a public working exploit or scanner template caps near-term automated exploitation, but the unresponsive maintainer means the exposure window is open-ended with no committed remediation timeline. Confidentiality, integrity, and availability impacts are each rated low individually (C:L/I:L/A:L), but in an agentic context 'low' impact on an authorization check can cascade into unauthorized privileged actions, making the real-world blast radius larger than the raw CVSS score suggests.

How does the attack unfold?

Initial Access

Attacker reaches the openclaw-cn auto-reply agent remotely over its messaging channel with only low-level access, no authentication bypass or user interaction needed on the victim's part.

AML.T0049

Privilege Check Bypass

Attacker's message/sender identifier satisfies the flawed isApprovedElevatedSender logic, causing the agent to misclassify them as an approved elevated sender (CWE-266/CWE-269).

Privileged Action Execution

The agent processes the attacker's subsequent input through the elevated auto-reply code path, executing privileged commands or tool invocations reserved for trusted senders.

AML.T0053

Impact

Unauthorized privileged actions occur within the auto-reply workflow (e.g., admin-level commands or approvals), undermining the integrity of the agent's trust model with no official patch available.

Initial Access

Attacker reaches the openclaw-cn auto-reply agent remotely over its messaging channel with only low-level access, no authentication bypass or user interaction needed on the victim's part.

AML.T0049

Privilege Check Bypass

Attacker's message/sender identifier satisfies the flawed isApprovedElevatedSender logic, causing the agent to misclassify them as an approved elevated sender (CWE-266/CWE-269).

Privileged Action Execution

The agent processes the attacker's subsequent input through the elevated auto-reply code path, executing privileged commands or tool invocations reserved for trusted senders.

AML.T0053

Impact

Unauthorized privileged actions occur within the auto-reply workflow (e.g., admin-level commands or approvals), undermining the integrity of the agent's trust model with no official patch available.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

No official patch exists (maintainer unresponsive since the issue was filed). Recommended steps: 1) Review the isApprovedElevatedSender implementation in src/auto-reply/reply/reply-elevated.ts and patch the comparison/validation logic locally or in a fork before deploying; 2) Disable or gate the elevated auto-reply feature entirely until a fix lands; 3) Enforce sender authorization at an independent layer (e.g., gateway/allow-list outside the bot's own logic) rather than relying solely on the vulnerable function; 4) Add logging and alerting for any elevated-sender action, and audit recent logs for anomalous elevated actions from unexpected sender identifiers; 5) Track the upstream repo (github.com/mf-yang/openclaw-cn) and issue #564 for a fix or community patch.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN 1.5 - Risk monitoring and accountability mechanisms

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-19007?

This vulnerability lives in the isApprovedElevatedSender function of openclaw-cn, an AI auto-reply agent, and stems from improper privilege management (CWE-266/CWE-269) that lets a remote attacker have their messages treated as coming from an approved elevated (trusted/admin) sender. Because the flaw sits in a network-reachable authorization check requiring only low privileges and no user interaction (AV:N/AC:L/PR:L/UI:N), an attacker with minimal access to the bot's messaging channel could trigger privileged auto-reply behavior meant only for trusted senders. VulDB has published the technical details and the issue is flagged as publicly disclosed, and while EPSS sits at the 89th percentile it's still a low absolute score (0.2%), it's not in CISA KEV, and no working exploit tool or Nuclei template exists yet, so mass exploitation is unlikely though targeted abuse is plausible. The maintainer was notified via GitHub issue #564 and has not responded, meaning there is no official patch. Until upstream fixes it, disable or restrict elevated-sender auto-reply commands, enforce sender authorization at an independent gateway layer rather than trusting the bot's internal check, and monitor logs for elevated actions triggered by unexpected senders.

Is CVE-2026-19007 actively exploited?

No confirmed active exploitation of CVE-2026-19007 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19007?

No official patch exists (maintainer unresponsive since the issue was filed). Recommended steps: 1) Review the isApprovedElevatedSender implementation in src/auto-reply/reply/reply-elevated.ts and patch the comparison/validation logic locally or in a fork before deploying; 2) Disable or gate the elevated auto-reply feature entirely until a fix lands; 3) Enforce sender authorization at an independent layer (e.g., gateway/allow-list outside the bot's own logic) rather than relying solely on the vulnerable function; 4) Add logging and alerting for any elevated-sender action, and audit recent logs for anomalous elevated actions from unexpected sender identifiers; 5) Track the upstream repo (github.com/mf-yang/openclaw-cn) and issue #564 for a fix or community patch.

What systems are affected by CVE-2026-19007?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chatbot/auto-reply pipelines.

What is the CVSS score for CVE-2026-19007?

CVE-2026-19007 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

agent frameworkschatbot/auto-reply pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN 1.5

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with basic reach to the messaging channel the bot monitors crafts a message or sender identifier designed to satisfy the flawed isApprovedElevatedSender validation — for example exploiting a missing scope/format check on the sender field. The auto-reply agent evaluates this check, incorrectly classifies the attacker as an approved elevated (trusted/admin) sender, and processes their subsequent messages using the privileged auto-reply code path. Depending on what 'elevated' actions the agent exposes, this could let the attacker trigger administrative commands, approve actions, or invoke privileged integrations that were intended to be restricted to a small trusted group — all without needing valid admin credentials, just a way to reach the bot remotely.

Weaknesses (CWE)

CWE-266 Incorrect Privilege Assignment Primary CWE-269 Improper Privilege Management Primary CWE-266 Incorrect Privilege Assignment CWE-269 Improper Privilege Management

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.