Executive brief
OpenClaw is an API gateway that controls access to backend services via WebSocket connections. A logic flaw in WebSocket authentication allowed shared-token authenticated clients to self-declare elevated administrative scopes (like operator.admin) without server verification, bypassing intended authorization controls. An attacker with a shared secret could perform admin-only operations, potentially gaining full control over gateway functionality.
Technical details
The vulnerability is a missing authorization check (CWE-862) and improper privilege management (CWE-269) in the WebSocket connection handler. Device-less shared-token or password-authenticated connections could retain client-declared scopes without server-side binding or validation. The root cause is that unbound scopes (those not tied to a device identity or explicitly trusted Control UI path) were not cleared before accepting the connection. An attacker with knowledge of a shared secret could craft a WebSocket connection declaring elevated scopes such as operator.admin, and the gateway would accept these unvalidated claims. The fix (version 2026.3.12) introduces clearUnboundScopes() logic to strip undelegated scopes on shared-token auth connections.
Affected products
- OpenClaw openclaw <= 2026.3.11
Timeline
- 2026-03-13: disclosed: GHSA-rqpp-rjj8-7wv8 published
- 2026-03-12: patched: Fix released in openclaw 2026.3.12