OpenClaw versions prior to 2026.4.20 contain a missing‑authorization flaw in the agent‑facing gateway configuration endpoints config.patch and config.apply. The flaw allows an attacker who can use the owner‑only gateway tool, such as a prompt‑injected model, to make and persist unauthorized changes to operator‑trusted settings. These settings include sandbox policy, plugin enablement, gateway authentication and TLS, hook routing, MCP server configuration, SSRF policy, and filesystem hardening. The consequence is unauthorized modification of critical configuration, which can lead to a compromise of system integrity and potentially elevate the attacker’s privileges within the OpenClaw environment.

The affected product is OpenClaw by OpenClaw. Versions before 2026.4.20 are vulnerable. The guard bypass occurs in the agent-facing gateway configuration endpoints config.patch and config.apply.

The CVSS score of 6 indicates a medium severity vulnerability. The exploitation probability is not available, so the likelihood of an attack remains uncertain, though it is not listed in CISA’s KEV catalog. Attackers would need access to the owner‑only gateway tool, which is typically used by trusted operators, suggesting that the threat likely originates from an internal actor or a compromised agent environment. Once the fault is exploited, the attacker can persist forbidden changes to protected operator settings, potentially disrupting service or enabling further escalated attacks.