CVE-2026-100578: OpenClaw before 2026.7.1 Authorization Bypass via chat.send
OpenClaw (npm package openclaw) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the gateway and cron tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove gateway and cron from affected agent tool policies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.7.1 - Configuration
In identity-bearing deployments, restrict chat.send to administrators.
OpenClaw Gateway chat.send authorization = administrators only - Configuration
Remove the gateway and cron tools from affected agent tool policies.
OpenClaw agent tool policies enabled tools = exclude gateway and cron
Event History
Frequently Asked Questions
Which deployments and callers are exposed?
Gateway deployments that use authentication modes honoring caller identity and narrower operator scopes are affected when a write-scoped, non-owner caller can access chat.send. Shared-secret token and password callers are treated as fully trusted operators and are outside the scope of this issue.
What does an attacker need to exploit this issue?
The attacker needs write-scoped non-owner access and the ability to start a chat turn through chat.send. Exploitation also depends on the affected agent's tool inventory including gateway or cron and on the caller being able to steer the model to invoke those tools.
What can be done before upgrading?
Restrict chat.send to administrators in identity-bearing deployments. Remove gateway and cron from affected agent tool policies to prevent those owner-only infrastructure tools from being available during chat turns.
How can I determine whether my deployment is affected?
Check whether OpenClaw is earlier than 2026.7.1 and whether your Gateway uses identity-bearing authentication with scoped operators. Then verify whether write-scoped non-owner users can call chat.send and whether affected agent policies expose the gateway or cron tools.