Executive brief
OpenClaw is a messaging framework that supports slash commands with owner-only protections. A configuration error allows non-owner users to execute sensitive owner-only commands (like /send, /config, and /debug) when wildcard senders are permitted without explicit owner restrictions. This could enable unauthorized users to modify channel configuration or send messages on behalf of the service.
Technical details
This is an authorization bypass vulnerability (CWE-862) in the command-auth.ts module. The root cause is that when a channel accepts wildcard inbound senders (allowFrom: ["*"]) and enforces owner-only commands, the code incorrectly reuses the wildcard allowFrom setting to determine command ownership, instead of requiring an explicit owner identity or operator-admin scope. An unauthenticated or non-owner sender can exploit this over the network by sending owner-enforced slash commands on affected channels. The vulnerability only affects the command-owner authorization check and does not grant tool access, sandbox access, or gateway administrator privileges. The fix was released in version 2026.4.21, which requires either a concrete owner identity or internal operator-admin scope for owner-enforced commands.
Affected products
- OpenClaw OpenClaw <= 2026.4.20
Timeline
- 2026-04-22: disclosed
- 2026-04-21: patched: Version 2026.4.21 released with fix
- 2026-05-11: advisory: GHSA-p3pv-c954-9m6f published (later withdrawn as duplicate)