CVE-2026-100525
Received Received - Intake

OpenClaw Prometheus Plugin Missing Scope Enforcement

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective role has no read scope can retrieve the diagnostics document even though ordinary read methods reject the same identity, disclosing operational metrics to an authenticated profile intentionally limited below read access. Shared-secret Gateway callers already hold the documented full operator scope and are not affected. The issue is fixed in 2026.9.3; as a workaround, disable the Prometheus endpoint or ensure every identity that can reach it is intended to hold operator.read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100525
EUVD
EUVD-2026-87525

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw diagnostics_prometheus to 2026.9.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The OpenClaw Prometheus diagnostics plugin before version 2026.9.3 has an authentication bypass flaw. It fails to enforce the operator.read scope on its metrics endpoint. This allows an authenticated user without read permissions to access operational metrics through the Prometheus endpoint, even though other read methods correctly reject the same user.

Detection Guidance

Check if the OpenClaw Prometheus diagnostics plugin version is below 2026.9.3 by running: npm list @openclaw/diagnostics-prometheus. If the version is outdated, the vulnerability may be present.

Impact Analysis

This vulnerability exposes sensitive operational metrics to unauthorized users. Attackers with limited access could retrieve internal system data, potentially aiding further attacks. It undermines access control by bypassing intended permission restrictions.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by exposing operational metrics to unauthorized users. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. Unauthorized access to diagnostics data may constitute a breach of these regulations.

Mitigation Strategies
  • Upgrade the OpenClaw Prometheus diagnostics plugin to version 2026.9.3 or later.
  • Disable the Prometheus endpoint if upgrading is not immediately possible.
  • Ensure all identities accessing the Prometheus endpoint have the operator.read scope.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100525. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart