Executive brief
OpenClaw is a popular Node.js application platform that allows plugins to define HTTP routes and integrate with the gateway's privileged operations. A vulnerability in versions 2026.3.7–2026.3.11 allows unauthenticated remote requests to plugin-owned routes to bypass authorization checks and execute administrative gateway actions (such as session deletion or agent execution) by exploiting a synthetic operator client with overly broad privileges.
Technical details
The vulnerability is an authorization bypass (CWE-285/CWE-269) in OpenClaw's plugin subagent runtime. When plugin-owned routes call runtime.subagent methods, the gateway dispatches those calls through a synthetic operator client with administrative scopes, rather than propagating the original caller's authentication context and least-privilege scope. This allows an unauthenticated network-accessible request to a public plugin route to invoke privileged gateway operations such as session deletion, session data reading, or agent execution. The fix, released in version 2026.3.11, propagates the real gateway client into the subagent runtime and restricts unauthenticated plugin-route access to non-admin scopes.
Affected products
- OpenClaw OpenClaw 2026.3.7 to 2026.3.10
Timeline
- 2026-03-12: disclosed
- 2026-03-31: advisory: GHSA-phgf-3849-rgjq published; marked as duplicate of GHSA-xw77-45gv-p728
- 2026-03-11: patched: Fix released in version 2026.3.11