Executive brief
OpenClaw, a communication and command gateway, contains a flaw where certain restricted administrative commands can be executed by users who should not have permission to do so. By sending specific chat messages through certain network routes, a user with basic write access can bypass security checks to perform sensitive actions like changing configurations, managing plugins, or modifying access control lists. This could allow an attacker to take full control over the system's administrative functions.
Technical details
A vulnerability in OpenClaw's Gateway involves incorrect authorization (CWE-863) when processing 'chat.send' requests. When a request is delivered through an inherited external route, the system may evaluate it as an external-channel command while failing to enforce the required high-level scopes (operator.approvals or operator.admin). An attacker with 'operator.write' privileges can exploit this to execute administrative commands, including plugin management, configuration changes, and allowlist mutations. The issue is specific to scoped Gateway clients and does not affect shared-secret bearer HTTP endpoints. A fix is available in version 2026.5.18.
Affected products
- openclaw openclaw < 2026.5.18
Timeline
- 2026-05-28: disclosed: Initial disclosure by reporter
- 2026-05-28: patched: Version 2026.5.18 released
- 2026-07-02: advisory: GitHub Advisory published