The vulnerability resides in OpenClaw versions earlier than 2026.3.11. Plugin subagent routes are executed using a synthetic operator client that has broad administrative scopes. This allows attackers to send remote requests to plugin‑owned routes without authentication, and the gateway will invoke runtime.subagent methods. The attacker can perform privileged gateway actions such as deleting sessions and causing an agent to execute. The weakness is an authorization bypass, classified as CWE‑266, and the impact includes unauthorized modification of configuration and execution of arbitrary commands.

Affected products are OpenClaw OpenClaw platform versions 2026.3.7 through 2026.3.10. The vulnerability manifests in Node.js deployments of OpenClaw. Users running any of these pre‑2026.3.11 releases are susceptible.

The CVSS score is 9.2, indicating high severity. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the flaw permits remote unauthenticated access to privileged operations, making exploitation highly attractive to attackers. The expected attack path involves sending crafted HTTP requests to plugin subagent endpoints, leveraging the synthetic admin scopes to execute gateway methods.