Executive brief
OpenClaw is an application framework that provides gateway APIs for handling chat-based requests. A privilege escalation flaw allows users with basic write permissions to persist verbose logging settings that should be restricted to administrators, potentially exposing sensitive reasoning and tool output that was intended to remain hidden from non-admin users.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863, CWE-284) in the chat.send endpoint that allows write-scoped gateway callers to persist the /verbose parameter and override session-level logging controls. The root cause lies in insufficient access control checks in src/auto-reply/reply/directive-handling.impl.ts and src/gateway/sessions-patch.ts. Unlike the admin-only sessions.patch endpoint which properly restricts verboseLevel mutations, the chat.send endpoint does not validate authorization before persisting verbose overrides. An attacker with write-scoped gateway credentials can exploit this to enable verbose logging permanently, exposing administrative-level reasoning and tool output. The vulnerability was fixed in version 2026.3.28 via commit c603123528, which now requires admin authorization for persisted verbose defaults.
Affected products
- OpenClaw OpenClaw <= 2026.3.24
Timeline
- 2026-03-29: disclosed
- 2026-03-28: patched: Fix released in version 2026.3.28