A vulnerability in OpenClaw before version 2026.3.1 allows an authenticated caller with operator.write permissions to execute owner‑only tool surfaces—gateway and cron—through agent runs in deployments that use scoped tokens. The flaw results from an authorization mismatch during agent execution, enabling attackers to perform control‑plane actions beyond their intended scope. The vulnerability is classified as CWE‑863, a mismatch of authorization and needed privilege.

Vendors impacted are OpenClaw for its OpenClaw product. All releases older than 2026.3.1, running on a Node.js environment, are susceptible to this issue.

The flaw carries a CVSS score of 8.7, indicating high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate and possess operator.write scope; they can then trigger the exploit by initiating an agent run, which redirects them to owner‑only tools they are not authorized to use. Once triggered, the attacker gains unauthorized control‑plane capabilities that could affect confidentiality, integrity, and availability of the affected system.