GHSA-hw9r-h9mr-4jff: OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

Some internal command handlers check for the operator.approvals or operator.admin scope. When a scoped chat.send request was delivered through an inherited external route, the command was evaluated as an external-channel command, while the request still carried the lower Gateway client scopes. The scope gate did not apply in that routed context.

The attacker holds a scoped Gateway token with operator.write and can deliver chat.send into a session that has an external delivery route. That is a low-privilege position, such as a limited integration or a less trusted client. From there they can resolve approvals, which lets them approve their own pending exec requests, and change plugin, config, MCP, allowlist and ACP settings. Changing the allowlist or MCP configuration can widen what agents are allowed to do. The CVSS vector reflects full compromise of confidentiality, integrity and availability.

Shared-secret bearer HTTP compatibility endpoints are not affected. The advisory documents them as full operator surfaces under OpenClaw's trust model.

The npm package openclaw before 2026.5.18, on Gateways where scoped clients with operator.write can use chat.send to deliver into sessions that have an inherited external delivery route. Gateways that only issue full-operator shared-secret tokens are not affected by this path.

npm ls openclaw

Use npm ls -g openclaw for a global install. Versions below 2026.5.18 are affected.

Upgrade to [email protected] or later, the first stable patched version:

npm install [email protected]

Until then, the advisory says not to grant operator.write tokens to clients that can deliver commands into sessions with external routes, unless you trust those clients with admin-like command effects. Afterward, review plugin, config, MCP and allowlist settings for changes you did not make.

List the Gateway tokens that carry operator.write and the sessions that have external delivery routes. Review recent changes to plugin, config, MCP, allowlist and ACP settings, and approvals that were resolved, for any made by a client that only holds operator.write. The advisory gives no log string. Beam records MCP tool calls and agent actions on the machine, so changes to MCP configuration made by an agent may show up there.

Summary

Some internal command handlers require operator.approvals or operator.admin scopes. In affected releases, a scoped Gateway chat.send request delivered through an inherited external route could be evaluated as an external-channel command while still carrying the lower Gateway client scopes.

This issue affects scoped Gateway clients. It does not apply to shared-secret bearer HTTP compatibility endpoints, which are documented as full operator surfaces under OpenClaw's trust model.

Affected configurations

This affects deployments where a scoped Gateway caller with operator.write can use chat.send with delivery into a session that has an inherited external delivery route.

Impact

Commands that should have required operator.approvals or operator.admin could run with only operator.write in this routed context. Affected command families included approval resolution and selected administrative commands such as plugin, config, MCP, allowlist, and ACP mutations.

Patched Versions

The first stable patched version is 2026.5.18.

Mitigations

Upgrade to [email protected] or later. Before upgrading, avoid granting operator.write tokens to clients that can deliver commands into sessions with external routes unless those clients are trusted with admin-like command effects.