CVE-2026-35674: OpenClaw Gateway Scope Bypass Privilege Escalation

Technical summary

CVE-2026-35674 is a scope bypass vulnerability in OpenClaw's Gateway chat.send route. The flaw stems from insufficient authorization checks on the inherited external routes used by the chat messaging system. Attackers possessing operator.write scope can craft messages that traverse these routes to execute operations normally guarded by operator.approvals and operator.admin scope requirements. The vulnerability permits unauthorized mutations to plugins, configurations, MCP (Model Context Protocol) settings, allowlists, and ACP (Access Control Policy) definitions. The root cause maps to CWE-863 (Incorrect Authorization), indicating a logic error in how scope inheritance and route access are validated.

Business impact

This vulnerability creates a path for insiders or compromised low-privilege accounts to gain effective administrative control without detection or approval workflows. An attacker could modify plugin behavior to exfiltrate data, alter security configurations to disable protections, or inject malicious MCP definitions to compromise downstream operations. Organizations relying on role-based access controls and approval gates for compliance or operational security will see those controls circumvented. The high CVSS score (8.8) reflects the combination of network accessibility, low complexity, and high impact across confidentiality, integrity, and availability.

Affected systems

OpenClaw versions prior to 2026.5.18 are affected. Organizations should verify their deployed version by checking the OpenClaw version identifier in their deployment. All instances with network-accessible Gateway endpoints and users holding operator.write scope are at risk, regardless of cluster size or configuration variant.

Exploitability

Exploitation requires network access to the OpenClaw Gateway (implied by the CVSS vector AV:N) and an existing account with at minimum operator.write scope permissions. No user interaction is needed; the attacker sends crafted chat messages programmatically. Exploitation difficulty is low (AC:L), and the attack chain is straightforward once the attacker understands the route inheritance mechanics. No public exploit code has been designated for KEV tracking, but the simplicity and deterministic nature of the flaw make it likely to be weaponized quickly if not patched.

Remediation

Upgrade OpenClaw to version 2026.5.18 or later. This release includes authorization logic corrections to validate scope requirements on inherited external routes before permitting command execution. Organizations unable to upgrade immediately should review audit logs for suspicious chat.send messages originating from operator.write-scoped users and consider restricting network access to the Gateway endpoint or temporarily elevating monitoring on high-risk operations (plugin, config, MCP, allowlist, and ACP mutations).

Patch guidance

Apply OpenClaw 2026.5.18 or later as soon as possible. Verify the patch version in your deployment by checking the version reported by the OpenClaw API or administrative console. Test the upgrade in a non-production environment first to confirm compatibility with custom plugins and configurations. Monitor logs during and after the upgrade for any authorization-related warnings or errors. Rollback procedures should be documented before patching production systems.

Detection guidance

Look for chat.send API calls that originate from accounts with operator.write scope and result in mutations to plugins, configs, MCP settings, allowlists, or ACP policies. Audit logs should record the scope of the calling principal and the target resource. Alert on discrepancies where an operator.write-scoped caller successfully modifies resources that should require operator.approvals or operator.admin scope. Correlate chat message timing with unexpected configuration changes. Query for API responses indicating authorization success (HTTP 200/201) on privileged endpoints when initiated by low-scope principals.

Why prioritize this

HIGH priority. The combination of low exploitation barriers (low AC, network-reachable, only operator.write required), absence of user interaction, and high impact (full confidentiality, integrity, and availability compromise) makes this a critical risk. Organizations should patch within 48–72 hours if feasible. The vulnerability directly undermines access control and approval workflows, which are often centerpieces of security policy and compliance posture.

Risk score, explained

CVSS 8.8 (HIGH) reflects: AV:N (network-accessible Gateway), AC:L (no special conditions required to craft messages), PR:L (attacker must hold operator.write role, but this is typically not the most privileged role), UI:N (no social engineering or user prompt needed), S:U (impact confined to the affected system), C:H (confidentiality compromised via unauthorized mutation access), I:H (integrity compromised via unauthorized config/policy changes), A:H (availability compromised if MCP or allowlist changes disrupt service). The flaw is a textbook privilege escalation and merits rapid remediation.

Frequently asked questions