Executive brief
OpenClaw is an AI automation platform that manages command execution across channels and roles. A bug in its internal/webchat command authorization allows authenticated users to inherit elevated permissions across channel boundaries, potentially bypassing access controls designed to restrict who can run critical commands. An attacker with low-privilege access to one channel could escalate to owner-level capabilities in another channel, depending on configuration.
Technical details
This vulnerability (CWE-863: Incorrect Authorization) affects the internal and webchat command authentication in OpenClaw versions through 2026.4.24. The root cause is improper inheritance of wildcard ownerAllowFrom state across channel boundaries, allowing a sender on an affected internal or webchat path to inherit authorization privileges outside the intended channel scope. Exploitation requires network reachability and low-level authentication privileges; attack complexity is low and user interaction is not required. An authenticated attacker can execute owner-style command behavior that should have remained channel-scoped, potentially gaining unauthorized control over commands and automation. The vulnerability is patched in version 2026.4.25. Workarounds include keeping owner command allowlists explicit per channel, maintaining narrow channel/tool allowlists, avoiding shared Gateways between mutually untrusted users, and disabling the feature when not needed.
Affected products
- openclaw openclaw <=2026.4.24
Timeline
- 2026-06-18: disclosed: Advisory GHSA-4hpg-mp64-x7xq published
- 2026-04-25: patched: First stable patched version 2026.4.25 released