OpenClaw Privilege Escalation Vulnerability in Chat Endpoint

A privilege escalation vulnerability has been identified in OpenClaw versions prior to 2026.3.28. The issue resides in the chat.send endpoint, where write-scoped gateway callers can manipulate the /verbose parameter to persist admin-only session overrides. This exploitation allows the unauthorized exposure of sensitive information or tool outputs meant solely for administrators.

Impact

Exploitation of this vulnerability enables write-scoped gateway callers to persistently override verbose output settings, potentially exposing more detailed reasoning or tool outputs than intended by the administrator.

Remediation

Users can upgrade to OpenClaw version 2026.3.28 or later to address this vulnerability.