OpenClaw Privilege Escalation Vulnerability in Gateway Plugin HTTP Authentication

A privilege escalation vulnerability has been identified in OpenClaw versions prior to 2026.4.8. The issue resides in the gateway plugin's HTTP authentication mechanism, where identity-bearing 'operator.read' requests are improperly elevated to 'operator.write' permissions. This vulnerability allows unauthorized write access to runtime operations by sending read-scoped requests through the gateway authentication route.

Impact

Exploitation of this vulnerability allows for unauthorized write access to runtime operations, bypassing intended read-only permissions.

Reproduction

The vulnerability can be reproduced by sending HTTP requests that include the 'operator.read' identity scope through the gateway authentication route. The gateway plugin will incorrectly grant 'operator.write' permissions, allowing unauthorized modifications to runtime operations.

Remediation

Users can upgrade to OpenClaw version 2026.4.8 or later to address this vulnerability.