Junglewise Threat Intelligence

CVE-2026-42429: OpenClaw privilege escalation in gateway plugin HTTP authentication

CVE-2026-42429 · Severity: high · CVSS 7.1 · Published 2026-04-28

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a user-controlled local assistant that includes a Gateway plugin for handling HTTP authentication. A privilege escalation vulnerability allows the plugin to incorrectly grant write permissions to runtime operations when requests should only have read access, potentially enabling attackers to make unauthorized changes to system state. This vulnerability is scoped to OpenClaw's trust model and does not assume multi-tenant service boundaries.

Technical details

This vulnerability is an authorization bypass (CWE-863, CWE-269) in the Gateway plugin's HTTP authentication handler. When using the `auth: gateway` configuration, the plugin fails to properly restrict the scope of permissions granted from upstream trusted-proxy requests. Specifically, read-only (`operator.read`) requests are incorrectly widened to include write (`operator.write`) permissions at runtime. The attack requires local/direct access to the gateway interface and relies on crafting requests through the trusted-proxy mechanism. An attacker can exploit this to perform unauthorized write operations on the OpenClaw runtime. The vulnerability was patched in version 2026.4.8 (commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5), with the fix verified through targeted regression tests.

Affected products

  • OpenClaw openclaw prior to 2026.4.8, including 2026.1.29

Timeline

  • 2026-04-09: disclosed: GHSA-4f8g-77mw-3rxc published
  • 2026-04-08: patched: Fix released in version 2026.4.8
  • 2026-04-28: kev added: NVD publication of CVE-2026-42429

References

Related threats