Executive brief
OpenClaw is an AI automation platform that executes tasks across multiple systems. The vulnerability allows users with basic "operator.write" permissions to toggle persistent memory dreaming settings—an admin-level configuration—through the `/dreaming` gateway endpoint, effectively escalating their privileges to administrative level and gaining control over system configuration they should not be able to modify.
Technical details
The vulnerability is a privilege escalation (CWE-266, CWE-863) affecting OpenClaw's gateway API. Users with the write-scoped operator role could call the `/dreaming on|off` endpoint to toggle persistent memory dreaming configuration, which is an admin-class mutation that should have required the `operator.admin` role. The root cause was missing authorization checks on the gateway path; the fix (PR #63872, commit 6af17b39e11f5f35e23b7e5a5f71a7d0aa3c7310) adds a requirement for `operator.admin` scope on persistent dreaming gateway toggles and normalizes missing gateway client scopes to empty (unprivileged) instead of silently permitting config writes. The attack requires network access to the gateway and valid write-level credentials but no special interaction; exploitation allows arbitrary modification of memory dreaming persistence settings. Patch available in v2026.4.10 and later.
Affected products
- OpenClaw openclaw >= 2026.4.5 < 2026.4.10
Timeline
- 2026-04-17: disclosed
- 2026-04-10: patched: Fixed in v2026.4.10; latest npm release 2026.4.14 includes fix