Executive brief
OpenClaw is a gateway platform that manages device access and command execution across distributed systems. A vulnerability allows clients with chat-only write permissions to bypass authorization and approve or deny critical executive requests that they should not have access to. In multi-client environments where different devices have intentionally limited permissions, this could let an attacker with basic chat access escalate their capabilities by approving commands they were explicitly denied.
Technical details
This is an incorrect authorization vulnerability (CWE-863) in the /approve chat command handler. A client authenticated with only operator.write permission (chat access) could send the /approve command to approve/deny exec approval requests, even though this action should require operator.approvals permission. The root cause is that exec.approval.resolve is correctly gated by operator.approvals when called directly via RPC, but the /approve chat command invoked this function through an internal privileged gateway client without re-checking the caller's permissions. Attack requires network access and an authenticated device token, but no further user interaction. An attacker can approve or deny pending exec requests, potentially disrupting operations or gaining unauthorized command execution. The fix, released in version 2026.2.2, adds an explicit permission check in the command handler to require operator.approvals or operator.admin roles.
Affected products
- OpenClaw openclaw < 2026.2.2
Timeline
- 2026-02-17: disclosed: Advisory published on GitHub and OSV
- 2026-02-17: patched: Fix released in version 2026.2.2
- 2026-03-05: other: Published to NVD