Executive brief
OpenClaw is a popular npm package used for message queuing and batch processing. A flaw in its collect-mode feature allows queued messages from different senders to be processed together using the authorization level of the final sender, potentially granting lower-privileged messages higher-level access. This could enable unauthorized users to perform actions they normally cannot access through privilege escalation.
Technical details
The vulnerability is a privilege escalation / authorization context confusion issue (CWE-266, CWE-863) in OpenClaw's collect-mode queue batch processing. When multiple messages from different senders are queued for batch dispatch, the system incorrectly reuses the authorization context of the last sender for the entire batch, instead of preserving each message's individual trust state. The attack requires the attacker to be an authenticated user who can send messages to a collect-mode queue. An attacker can craft a sequence of messages such that lower-privileged messages are processed with higher privileges inherited from a subsequent message sent by a more privileged user. The vulnerability was fixed in version 2026.4.14 by splitting collect-mode batches by sender authorization context before dispatch.
Affected products
- OpenClaw OpenClaw < 2026.4.14
Timeline
- 2026-04-17: disclosed: Advisory published
- 2026-04-14: patched: Fixed in version 2026.4.14