OpenClaw Windows Node releases before 2026.7.1-3 contain a missing authorization check in NodeService capture handlers. The service accepts WebSocket calls to screen.snapshot, camera.snap, and location.get without validating the caller’s permissions. An attacker that can bind a gateway or agent to the node can invoke these actions silently, capturing screenshots, photographing users through webcams, and retrieving device geolocation without any user interaction or consent prompts, thereby exposing confidential information and violating privacy.

All OpenClaw Windows Node installations running a version earlier than 2026.7.1-3, such as the 2026.7.1-2 build, are affected. The vulnerability is present in the NodeService component exposed over the node’s WebSocket interface.

The flaw carries a CVSS score of 7.1, indicating moderate to high risk. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the node WebSocket, which can be exploited by a compromised or malicious gateway or agent that connects to the node. Because no user interaction is required, the potential for silent data exfiltration is significant, and remediation is urgently recommended.