Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100578OpenClaw before 2026.7.1 Authorization Bypass via chat.send
High 7.6
In plain English
A high-severity privilege mismanagement in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the `gateway` and `cron` tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies.
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
References
- GitHub Security Advisory (GHSA-qw7m-h363-33qw) vendor-advisory
- VulnCheck Advisory: OpenClaw before 2026.7.1 Authorization Bypass via chat.send third-party-advisory