The vulnerability allows attackers to elevate privileges by abusing the gateway plugin’s HTTP authentication mechanism. By sending read‑scoped requests through the gateway authentication route, an attacker can gain operator.write permissions for runtime operations. This effectively turns a normally restricted read request into a write capability, allowing unauthorized modification or execution of runtime actions.

OpenClaw software, all versions earlier than 2026.4.8. This includes every released build prior to the 2026.4.8 update.

The CVSS score of 6.0 indicates medium severity. No publicly disclosed exploits are listed in the KEV catalog, and exploit probability data (EPSS) is unavailable, suggesting limited or no evidence of active exploitation. The attack requires only an HTTP request to the gateway authentication route—a path typically exposed to network clients—making the vulnerability theoretically reachable and presenting a moderate risk of privilege escalation.