Executive brief
OpenClaw, a platform for managing agents and plugins, contains a security flaw in how it handles plugin requests. An attacker can send a specially crafted request to a plugin's web address to gain administrative control over the system without needing a password. This could allow an unauthorized person to delete user sessions, access sensitive data, or execute unauthorized commands on the server.
Technical details
An authorization bypass exists in OpenClaw's plugin subagent runtime. When a plugin-owned HTTP route (using auth: 'plugin') invokes 'runtime.subagent.*' methods, the system dispatches these calls using a synthetic operator client that possesses broad administrative scopes rather than the caller's actual context. A remote, unauthenticated attacker can exploit this by sending requests to plugin-owned routes to perform privileged actions such as session deletion, reading session data, or triggering agent execution. The vulnerability is rooted in the failure to propagate the original caller's authentication context or enforce least-privilege scopes. This issue was fixed in version 2026.3.11 by ensuring the real gateway client is propagated and capping unauthenticated access to non-admin scopes.
Affected products
- OpenClaw OpenClaw >= 2026.3.7, < 2026.3.11
Timeline
- 2026-03-12: advisory: GitHub Security Advisory GHSA-xw77-45gv-p728 published
- 2026-03-31: disclosed: CVE-2026-32916 published
- 2026-03-11: patched: Fixed in version 2026.3.11