Executive brief
OpenClaw is an AI automation platform that executes tasks across systems. A flaw in its access control allowed users with write-level permissions to invoke owner-only operations (gateway and cron tools) that should have been restricted to administrators. An authenticated attacker could exploit this to perform privileged actions beyond their intended scope in deployments using scoped tokens.
Technical details
The vulnerability is an authorization mismatch (CWE-269, CWE-863) where authenticated callers with operator.write scope could invoke owner-only tool surfaces (gateway, cron) through agent runs in scoped-token deployments. The root cause was improper privilege gating during agent execution. Attack preconditions require valid authentication with write-scope credentials and a scoped-token deployment. An attacker can perform control-plane actions beyond their intended write scope. The fix enforces owner-only gating consistently for these tool surfaces and tightens tool scope classification. Patch available in version 2026.3.1 and later.
Affected products
- OpenClaw OpenClaw <=2026.2.26
Timeline
- 2026-03-02: disclosed
- 2026-03-01: patched: Version 2026.3.1