Junglewise Threat Intelligence

OpenClaw incomplete gateway authorization in DM flows

Severity: medium · CVSS 4 · Published 2026-03-03

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is an AI automation tool that executes tasks across systems and platforms. This vulnerability allows authenticated non-owner users in direct message sessions to access owner-only gateway tools (cron, gateway, whatsapp_login) that should be restricted. The impact is limited since it requires authentication and a specific tool invocation path, but it could allow unauthorized users to schedule tasks or manipulate the system in ways reserved for owners.

Technical details

The vulnerability stems from incomplete authorization enforcement in gateway method calls used by agent tools. The root cause was inconsistent scope classification: some gateway call paths still used broader default scopes instead of method-level least-privilege scopes, and owner-only enforcement relied on tool-name checks rather than being consistently metadata-driven across all code paths. An authenticated non-owner user in a direct message session could exploit a specific tool invocation path to invoke owner-restricted tools (cron, gateway, whatsapp_login). The fix involved refactoring gateway method scope mapping into a data-driven table, centralizing owner-only enforcement through tool policy wrappers, explicitly marking owner-only tools in metadata, and adding regression tests to prevent scope drift.

Affected products

  • openclaw openclaw <= 2026.2.17

Timeline

  • 2026-03-03: disclosed: Advisory published
  • 2026-02-19: patched: Fix commits dated 2026-02-19; patched version 2026.2.19 released

References

Related threats