OpenClaw unauthorized configuration modification in gateway tool

Executive brief

OpenClaw, an AI agent framework, contained a security flaw in its gateway configuration tool. This tool is responsible for managing how AI models interact with system settings. A compromised or maliciously manipulated AI model could exploit this flaw to change sensitive system configurations, potentially leading to unauthorized command execution, data theft, or changes to security policies that persist even after a system restart.

Technical details

A missing authorization vulnerability (CWE-862) existed in OpenClaw's 'gateway' tool, specifically within the 'config.apply' and 'config.patch' functions. The system relied on a manual denylist to protect sensitive configuration paths, which became insufficient as the configuration schema expanded. An attacker leveraging a compromised AI model (e.g., via prompt injection) could bypass this boundary to modify critical settings related to TLS, proxy behavior, credential forwarding, and command execution. The vulnerability was remediated in version 2026.4.23 by replacing the denylist with a fail-closed allowlist that restricts agent-driven changes to a minimal set of safe parameters.

Affected products

• OpenClaw openclaw < 2026.4.23

Timeline

• 2026-04-24: patched: Fix commit bceda6089aa7b3695cc7696b43c61ae3d01bb0ec pushed
• 2026-05-05: advisory: GHSA-cwj3-vqpp-pmxr published

References

• https://api.github.com/users/zsxsoft
• https://github.com/zsxsoft
• https://api.github.com/users/zsxsoft/gists%7B/gist_id%7D
• https://api.github.com/users/zsxsoft/repos
• https://avatars.githubusercontent.com/u/2398785?v=4
• https://api.github.com/users/zsxsoft/events%7B/privacy%7D