OpenClaw versions earlier than 2026.2.2 contain an authorization bypass that allows a client with the operator.write scope to send a /approve chat command. The command internally routes through an internal privileged gateway client to invoke exec.approval.resolve, avoiding the operator.approvals permission check that protects direct RPC calls. This flaw enables an attacker to approve or deny execution approvals without the required authorization, potentially allowing the execution of arbitrary commands.

All OpenClaw installations running a version earlier than 2026.2.2 are vulnerable. The affected product is OpenClaw, a Node.js based chat integration platform.

The CVSS score of 7.2 indicates a medium to high severity. The EPSS score of <1% suggests a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. However, the vulnerability can be leveraged by any user possessing operator.write scope, which is typically granted to privileged operators. If an attacker gains such scope—either by compromise or misconfiguration—they could authorize malicious executions, leading to potential remote code execution or data tampering. The likely attack vector is the /approve chat command sent within the platform's chat interface.