CVE-2026-100525: OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass
The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective role has no read scope can retrieve the diagnostics document even though ordinary read methods reject the same identity, disclosing operational metrics to an authenticated profile intentionally limited below read access. Shared-secret Gateway callers already hold the documented full operator scope and are not affected. The issue is fixed in 2026.9.3; as a workaround, disable the Prometheus endpoint or ensure every identity that can reach it is intended to hold operator.read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@openclaw/diagnostics-prometheusto a version that resolves this vulnerability.Fixed in 2026.9.3 - Configuration
Disable the Prometheus endpoint as a workaround.
OpenClaw Prometheus diagnostics plugin Prometheus endpoint = disabled - Compensating control
Ensure every identity that can reach the Prometheus endpoint is intended to hold the operator.read scope.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using an identity-bearing Gateway authentication mode, such as trusted-proxy, are exposed if identities without operator.read can reach the authenticated Prometheus metrics endpoint. Shared-secret Gateway callers are not affected because they already have the documented full operator scope.
What access does an attacker need?
An attacker needs to authenticate through an affected identity-bearing Gateway mode as a caller whose effective role lacks read scope, and be able to reach the Prometheus endpoint. No user interaction is required.
What can be disclosed through exploitation?
The affected endpoint can return the diagnostics document, disclosing operational metrics to an authenticated profile that was intentionally restricted below read access. The provided information does not indicate integrity or availability impact.
What can be done before upgrading?
Disable the Prometheus endpoint, or ensure that every identity able to reach it is intended to have operator.read. The issue is fixed in version 2026.9.3.