CVE-2026-100578: OpenClaw Privilege Escalation Vulnerability

CVE-2026-100578 Overview

CVE-2026-100578 is an authorization bypass vulnerability in OpenClaw, distributed as the npm package openclaw, affecting versions prior to 2026.7.1. The flaw resides in the chat.send endpoint, which fails to restrict access to owner-only infrastructure tools. In Gateway deployments that honor caller identity, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the gateway and cron tools. The agent can then invoke owner-only configuration or scheduling operations, producing persistent state changes. The weakness is classified under [CWE-269: Improper Privilege Management].

Critical Impact
A low-privileged authenticated caller can trigger owner-only gateway and cron operations through the agent, enabling persistent configuration and scheduling changes without owner authorization.

Affected Products

OpenClaw npm package openclaw versions prior to 2026.7.1
OpenClaw Gateway deployments using identity-bearing authentication modes
Agent tool policies that include the gateway and cron tools

Discovery Timeline

2026-09-26 - CVE-2026-100578 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100578

Vulnerability Analysis

OpenClaw exposes a chat.send endpoint that dispatches user messages to an LLM-driven agent along with a tool inventory. In vulnerable releases, this endpoint does not evaluate caller scope against the sensitivity of the available tools. Owner-only tools such as gateway and cron are offered to the model regardless of whether the caller holds owner privileges.

The agent then selects and invokes tools based on the model's reasoning over the conversation. When a write-scoped non-owner caller steers a turn toward configuration or scheduling tools, the agent executes those actions under the server's trust boundary. The outcome is unauthorized configuration drift or scheduled jobs persisted by the Gateway.

Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and fall outside the scope of this issue.

Root Cause

The root cause is missing authorization enforcement at the tool exposure layer of chat.send. The endpoint relies on the agent runtime to mediate tool selection, but does not filter the tool inventory based on the caller's identity or scope. This mismatch between caller identity, agent capability, and tool authorization enables privilege escalation through the model.

Attack Vector

An authenticated non-owner caller with write scope sends a crafted prompt to chat.send in a Gateway deployment that honors caller identity. The caller steers the agent toward tool calls on gateway or cron. The agent invokes owner-only operations, persisting changes such as gateway reconfiguration or scheduled task creation. Practical impact depends on the tools the model selects and how effectively the caller steers the turn.

See the GitHub Security Advisory GHSA-qw7m-h363-33qw and the VulnCheck Authorization Bypass Advisory for additional technical context.

Detection Methods for CVE-2026-100578

Indicators of Compromise

Invocations of the gateway or cron tools in agent turn logs where the originating caller is not an owner.
Unexpected persistent state changes to Gateway configuration or scheduled jobs occurring shortly after chat.send requests.
chat.send requests from write-scoped identities that produce tool-call events referencing owner-only operations.

Detection Strategies

Correlate chat.send request logs with downstream tool-call audit records, flagging any mismatch between caller scope and tool sensitivity.
Alert on first-time use of gateway or cron tools by any non-owner identity.
Review agent turn transcripts for prompts that instruct the model to call configuration or scheduling tools.

Monitoring Recommendations

Enable full audit logging on OpenClaw Gateway, including caller identity, scope, selected tools, and tool arguments.
Monitor cron job inventories and gateway configuration state for unexpected changes and diff them against known-good baselines.
Forward OpenClaw audit logs into a centralized analytics platform to retain history for investigation and threat hunting.

How to Mitigate CVE-2026-100578

Immediate Actions Required

Upgrade the openclaw npm package to version 2026.7.1 or later across all Gateway deployments.
Audit agent tool policies and remove gateway and cron from tool inventories exposed to non-owner callers.
Review recent chat.send activity and tool-call history for unauthorized owner-only invocations and roll back any unauthorized state changes.

Patch Information

The issue is fixed in OpenClaw 2026.7.1. Operators running identity-bearing Gateway deployments should prioritize this upgrade. Deployments using shared-secret token or password authentication are not in scope because those callers are already treated as fully trusted operators under OpenClaw's security model.

Workarounds

Restrict chat.send to administrators in identity-bearing deployments until the upgrade is applied.
Remove gateway and cron from any agent tool policy accessible to non-owner callers.
Introduce a scope check at the Gateway or reverse proxy layer that rejects chat.send calls from write-scoped non-owner identities.

bash

# Upgrade OpenClaw to the patched release
npm install openclaw@2026.7.1

# Verify installed version
npm ls openclaw