The vulnerability resides in OpenClaw’s plugin install wrappers, which skip the configured install policy (authorization) check when the plugin install feature is enabled and reachable. A caller with lower trust or an input path that can reach the vulnerable code can trigger plugin installation or persistence actions that the caller is not entitled to perform. This flaw, identified as CWE‑863, allows an attacker to exercise privileged actions or maintain persistence beyond the permissions granted to the user.

OpenClaw installations running any version prior to 2026.6.9, specifically 2026.6.5 through 2026.6.8, are affected. The flaw exists only when the plugin install feature is enabled; systems with the feature disabled or with restrictive installation policies are not impacted.

The CVSS score of 6.9 classifies the vulnerability as medium severity, while the EPSS score of <1% indicates a low likelihood of exploitation. The attack requires network access to a reachable OpenClaw instance and the ability to invoke the plugin install endpoint. Based on the description, it is inferred that the attack vector involves network access to the plugin install endpoint, as the input does not explicitly state it. If a lower‑trust caller can reach the vulnerable path, the attacker may execute or persist unauthorized actions, but the overall risk remains moderate due to the restrictive conditions for exploitation.