CVE-2026-100578 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the `gateway` and `cron` tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within OpenClaw versions prior to 2026.7.1 represents a critical authorization bypass that allows non-owner users with write permissions to execute infrastructure-level operations intended exclusively for system administrators. This flaw resides in the handling of the chat.send endpoint, which serves as the primary interface for initiating agent interactions. In this context, the application fails to properly validate whether the tools requested or selected by the language model during a conversation turn are appropriate for the caller's assigned role and scope. Specifically, when operating within Gateway deployments that utilize authentication modes honoring caller identity and enforcing narrower operator scopes, the system incorrectly includes owner-only infrastructure tools such as gateway configuration management and cron job scheduling in the available tool inventory for these lower-privileged users. This misconfiguration enables a write-scoped non-owner caller to steer an agent conversation toward invoking commands that modify persistent state or alter critical system configurations, effectively elevating their privileges beyond what is permitted by their role definition.
From a technical perspective, this issue stems from insufficient access control checks during the tool selection phase of the agent execution pipeline. The vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as the application does not enforce strict separation between administrative functions and standard user operations. Furthermore, because the attacker can influence which tools are invoked by guiding the conversation through natural language prompts, this also reflects aspects of CWE-749 Exposed Dangerous Method or Endpoint if those methods lack proper input validation relative to caller identity. The operational impact is significant in environments where OpenClaw manages sensitive infrastructure components. An adversary who gains write access could potentially disrupt service availability by modifying gateway settings, schedule malicious tasks via the cron tool, or otherwise alter persistent state data that affects system integrity and confidentiality. This capability undermines the principle of least privilege and allows for potential denial-of-service conditions or unauthorized configuration changes that may persist across sessions due to the nature of the affected tools.
It is important to note the specific scope limitations defined by the vendor. The vulnerability does not affect deployments using shared-secret tokens or password-based authentication, as these modes treat callers as fully trusted operators under OpenClaw's security model and do not enforce granular role-based restrictions in the same manner. Therefore, organizations relying solely on those simpler authentication methods are not impacted by this specific privilege escalation vector. However, for identity-bearing deployments where fine-grained access control is expected, the risk is substantial. The practical impact depends heavily on the capabilities of the language model and the attacker's ability to successfully steer the agent toward invoking these restricted tools through crafted prompts.
To mitigate this vulnerability, organizations should immediately upgrade OpenClaw to version 2026.7.1 or later, which implements proper authorization checks for tool invocation based on caller identity. For environments where an immediate upgrade is not feasible, a recommended workaround involves restricting access to the chat.send endpoint exclusively to administrators in identity-bearing deployments. Additionally, security teams should audit and modify agent tool policies to explicitly remove gateway and cron tools from the inventory available to non-owner users. This ensures that even if a lower-privileged user initiates a conversation, the system will not expose or allow execution of infrastructure-level commands. Regular auditing of role-based access controls and continuous monitoring for anomalous configuration changes can further reduce the risk associated with similar privilege escalation attempts in AI-driven application architectures.