Executive brief
OpenClaw is a gateway service that manages communication and authorization. A security flaw allows users with basic 'write' permissions to bypass administrative restrictions and modify channel authorization settings. This means an attacker could grant themselves or others unauthorized access to private groups or direct messages, compromising the privacy and security of the communication platform.
Technical details
A privilege escalation vulnerability exists in OpenClaw's gateway where the '/allowlist' command fails to re-validate client scopes for internal callers. While direct configuration changes via 'config.patch' correctly require 'operator.admin' privileges, an attacker with 'operator.write' permissions can use the 'chat.send' function to trigger an internal command context. This context is treated as authorized by the '/allowlist' handler, allowing the attacker to persist changes to 'allowFrom' and 'groupAllowFrom' policies. This effectively bypasses the intended security boundary between standard write actions and administrative configuration management. The issue is fixed in version 2026.3.24 by adding sink-side internal admin checks to the allowlist component.
Affected products
- OpenClaw openclaw <= 2026.3.23
Timeline
- 2026-03-27: disclosed: Initial report by zpbrent
- 2026-03-30: advisory
- 2026-03-24: patched: Fixed in version 2026.3.24