Technical impact
The vulnerability allows an attacker to bypass authentication checks in the gateway‑authenticated plugin and receive a privileged operator.admin scope, even if the caller has no such rights. This incorrect scope assignment is a form of privilege escalation that lets the attacker perform unauthorized administrative actions. The weakness is identified as CWE‑648: Improper Authorization.
Affected Systems
The flaw affects OpenClaw software from all versions prior to 2026.3.25. The product is distributed by OpenClaw and is typically deployed in Node.js environments. Any installation that uses the gateway‑authenticated plugin HTTP routes is at risk unless it has been upgraded to version 2026.3.25 or later.
Risk and Exploitability
The CVSS score of 8.7 indicates high severity. Exploitation is likely achievable through HTTP requests to the gateway plugin, requiring legitimate authentication to access the route; the bug then grants admin privileges regardless of original scopes. EPSS data is not available, so the probability of exploitation cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog, but the high severity warrants prompt action.
Github GHSA