OpenClaw privilege escalation in Control UI WebSocket

Executive brief

OpenClaw, an AI assistant platform, contains a security flaw in its Control UI when configured to use a trusted proxy for authentication. An attacker with limited access could bypass security checks to gain full administrative control over the system. This could allow unauthorized users to access sensitive data or perform administrative actions, potentially compromising the entire platform.

Technical details

A missing or incorrect authorization vulnerability (CWE-862/CWE-863) exists in OpenClaw's Control UI when 'gateway.auth.mode' is set to 'trusted-proxy'. The application accepted a WebSocket client's self-declared operator scopes before they were validated against a server-approved pairing or authorization baseline. A network-based attacker with low privileges can present a fresh, unpaired device identity with elevated scopes to obtain 'operator.admin' authority. This authority can be used to execute admin-gated Gateway RPCs until the connection is terminated. The issue is fixed in version 2026.5.18.

Affected products

• OpenClaw openclaw < 2026.5.18

Timeline

• 2026-05-18: patched: First stable patched version released.
• 2026-07-02: advisory: GitHub Security Advisory published.

References

• https://api.github.com/users/adactum
• https://github.com/adactum
• https://api.github.com/users/adactum/gists%7B/gist_id%7D
• https://api.github.com/users/adactum/repos
• https://avatars.githubusercontent.com/u/277344436?v=4
• https://api.github.com/users/adactum/events%7B/privacy%7D