Executive brief
OpenClaw is an AI gateway that provides OpenAI-compatible interfaces. A security flaw allows users with restricted permissions to view a list of available AI models and their metadata, even if they are specifically blocked from doing so via other interfaces. While this does not expose private data or model weights, it allows unauthorized users to map out the system's capabilities and configuration.
Technical details
An authorization bypass exists in the OpenClaw HTTP compatibility layer. While the WebSocket RPC path correctly enforces the 'operator.read' scope for the 'models.list' method, the HTTP '/v1/models' endpoint only validates bearer authentication without checking for the specific required operator scope. An attacker with a valid but restricted token (e.g., 'operator.approvals') can successfully query model metadata via HTTP that would be rejected over WebSocket. This inconsistency allows for unauthorized information disclosure of gateway model configurations. The issue is addressed in version 2026.3.24 by enforcing scope gates on HTTP routes.
Affected products
- openclaw openclaw <= 2026.3.23
Timeline
- 2026-03-27: patched: Fixed in OpenClaw 2026.3.24
- 2026-03-30: advisory: GitHub Advisory published
- 2026-04-10: other: NVD published CVE-2026-35619