OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers

CAO 8.8CVE-2026-35669 · GHSA-qm2m-28pf-hgjw · Công bố 10/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-35669 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.30%, cao hơn 22.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.25 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.25`	`2026.3.25`
openclaw npm	`≤ 2026.3.24`	Chưa có bản vá

Mô tả

Summary

Gateway Plugin HTTP auth: "gateway" Mints operator.admin Runtime Scope

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

Gateway-authenticated plugin HTTP routes previously created a runtime scope set that included operator.admin regardless of caller-granted scopes. Commit ec2dbcff9afd8a52e00de054b506c91726d9fbbe keeps plugin HTTP runtime scopes least-privileged and preserves caller scope boundaries.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit ec2dbcff9afd8a52e00de054b506c91726d9fbbe.

Fix Commit(s)

ec2dbcff9afd8a52e00de054b506c91726d9fbbe

Mô tả của NVD

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gain elevated privileges and perform unauthorized administrative actions.