Executive brief
OpenClaw is a gateway service that routes and manages authenticated client communications. A vulnerability in its chat.send command handler allowed clients with basic write permissions (operator.write) to bypass authorization checks and make persistent configuration changes that should require admin-level access. An attacker with existing write access could modify system configuration without proper authorization, potentially disrupting service operation or changing security settings.
Technical details
OpenClaw chat.send processes slash commands (/config set, /config unset) in an internal gateway context with CommandAuthorized: true, but authorization checks only verified command-level permissions and channel-specific config gates without enforcing the admin-scoped operator.admin requirement for persistent config writes. An authenticated gateway client with operator.write privilege and chat.send access could route config mutations through the chat command handler to circumvent direct RPC method authorization boundaries. The fix restores authorization scope by requiring operator.admin credentials for persistent /config write operations routed through chat.send, while preserving read-only /config show availability to standard write-scoped clients. The vulnerability was patched in version 2026.3.7 released March 8, 2026.
Affected products
- OpenClaw openclaw <= 2026.3.2
Timeline
- 2026-03-09: disclosed
- 2026-03-08: patched: Fixed in version 2026.3.7