OpenClaw versions prior to 2026.5.18 contain a scope bypass flaw in the Gateway chat.send route that enables a client with operator.write permissions to send commands through inherited external routes. This bypass defeats the standard operator.approvals and operator.admin restrictions, allowing the attacker to execute privileged actions such as installing plugins, modifying configuration, manipulating MCPs, and altering allowlists and ACP entries. The weakness stems from improper privilege validation (CWE‑863) and effectively grants remote actors the ability to elevate their privileges within the system.

The affected product is OpenClaw OpenClaw, a node.js‑based platform. Vulnerable builds include all releases before the 2026.5.18 update; no other specific vendors or product lines are identified.

The CVSS score of 8.7 marks this as a high‑severity problem. Exploitation requires only the ability to obtain operator.write scope, after which the attacker can craft a payload directed via an inherited route to trigger the operator.approvals bypass. No EPSS data is available to estimate current threat prevalence, and the vulnerability is not listed in the CISA KEV catalog. The lack of additional prerequisites means that once operator.write scope is achievable, the attack is straightforward and could be executed remotely over the exposed Gateway interface.