Executive brief
OpenClaw is an AI automation platform that executes tasks across various systems and platforms. Two critical command paths—stop/abort triggers and the models listing command—fail to verify that the sender is authorized, allowing any attacker to disrupt active sessions or view sensitive model and authentication metadata that should be restricted.
Technical details
The vulnerability is an authorization bypass (CWE-863) where sender authentication checks are incorrectly implemented or missing in two command paths: stop-like natural-language abort triggers and the /models command output. An unauthenticated network attacker can invoke these endpoints without valid authorization credentials. Successful exploitation allows an attacker to terminate active AI sessions and enumerate available models and authentication configuration details. The fix enforces sender authorization checks on both vulnerable command paths; patches are available in version 2026.3.1 and later.
Affected products
- OpenClaw OpenClaw <= 2026.2.26
Timeline
- 2026-03-02: disclosed: GHSA-8m9v-xpgf-g99m published
- 2026-03-01: patched: Fix released in version 2026.3.1