GHSA-C28G-VH7M-FM7V: Improper Authorization and Privilege Escalation in OpenClaw Command Resolution

Vulnerability ID: GHSA-C28G-VH7M-FM7V

CVSS Score: 5.5

Published: 2026-04-29

OpenClaw contains an improper authorization vulnerability where the framework fails to adequately differentiate between channel-level access rights and administrative command ownership. When a wildcard channel configuration is employed without an explicitly defined owner allowlist, the fallback logic incorrectly grants administrative privileges to any user communicating on that channel.

TL;DR

A flaw in OpenClaw's authorization logic allows unprivileged users to execute administrative commands if the communication channel relies on a wildcard sender policy and an explicit owner allowlist is not configured.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-285, CWE-863

Attack Vector : Network / Communication Channel

Authentication Required : None

Impact : Privilege Escalation, Authorization Bypass

CVSS Score : 5.5…