Executive brief
OpenClaw is an AI agent automation platform that processes control-plane commands through chat-based administration interfaces. A missing access control check allowed users without administrative privileges to execute mutating (state-changing) commands that should have been restricted to administrators, potentially enabling unauthorized modifications to system configuration or operations.
Technical details
The vulnerability is a missing authorization check (CWE-862) in OpenClaw's internal Admin Control Panel (ACP) chat command handler. Mutating commands in src/auto-reply/reply/commands-acp.ts did not validate the operator.admin permission scope, allowing users with lower privilege levels to execute state-changing administrative operations. The attack requires network access to the OpenClaw service and valid authentication (operator scope but not admin scope), but no user interaction. An attacker can invoke administrative commands that modify system configuration, chat settings, or other control-plane state. The fix, shipped in version 2026.3.22, added explicit operator.admin scope enforcement checks with regression test coverage for both denied and successful cases.
Affected products
- OpenClaw openclaw < 2026.3.22
Timeline
- 2026-03-26: disclosed: Advisory published on GitHub and OSV
- 2026-03-22: patched: Fix shipped in version 2026.3.22
- 2026-03-15: other: Fix commit authored