OpenClaw versions older than 2026.4.23 contain an improper access control flaw in the gateway tool’s config.apply and config.patch operations. Because the tool does not fully enforce its denylist, a model that has already been compromised can inject unsafe configuration changes. These changes can alter command execution, network behavior, credentials, and operator policies, and they persist across restarts, giving the attacker a durable foothold. The weakness is a classic lack of proper access control (CWE‑184).

All deployments of OpenClaw OpenClaw running a pre‑2026.4.23 release are affected. Updating to the 2026.4.23 release or later removes the vulnerability.

The vulnerability has a CVSS score of 7.7, indicating a high severity. The EPSS score is not available, so the exploitation probability cannot be quantified, but the KEV status indicates it is currently not listed as a known exploited vulnerability. The likely attack vector requires that an adversary first compromise a model within the OpenClaw environment; once inside, the attacker can use the config.apply or config.patch functions to inject malicious configuration data that will be honored by the gateway tool. The persistence of these changes amplifies the risk, as the malicious configuration survives server restarts.