OpenClaw versions before 2026.7.1 allow a user with channel command access that is not the channel owner to approve or deny permission requests intended for the channel owner, bypassing the owner‑only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. This authentication bypass permits the non‑owner to grant or deny privileges that the owner intended to regulate, potentially enabling the execution of privileged actions or the provisioning of host capabilities without owner consent.

The vulnerability affects the openclaw npm package (OpenClaw). All deployments using OpenClaw versions earlier than 2026.7.1 are impacted. No specific sub‑product or additional vendor information is listed; the issue is fixed in the 2026.7.1 release.

The CVSS base score of 8.6 signifies high severity, and the EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via the MCP channel; an authorized non‑owner channel sender with channel command access can exploit the flaw. Successful exploitation would allow the attacker to approve or deny pending permission requests that affect the channel owner, potentially granting unauthorized action execution.