OpenClaw CVE-2026-100578

Requires an OpenClaw Gateway deployment (before 2026.7.1) running an authentication mode that honors caller identity and enforces narrower operator scopes, where the affected agent tool policy still includes the gateway and cron tools. The attacker must be an authenticated write-scoped non-owner caller (PR:L) able to reach the chat.send endpoint and steer the chat turn. Exploitation is NOT possible via shared-secret token or password callers (treated as fully trusted operators, out of scope), and is further limited by the fact that impact is contingent on the model actually selecting the owner-only tools during the turn. The documented workaround - restricting chat.send to administrators and removing gateway/cron from agent tool policies - also neutralizes the condition.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L, score 7.2) is internally consistent with the description: a network-reachable, low-privilege (write-scoped non-owner) caller with no user interaction can reach owner-only tooling, with the dominant impact being integrity (VI:H) via persistent configuration/scheduling changes, and only limited confidentiality/availability effect. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is no public exploit identified at time of analysis. A notable limiting factor stated by the vendor is that practical impact 'depends on the tools selected by the model and the caller's ability to steer the turn' - meaning exploitation is probabilistic/agent-mediated rather than a deterministic API call, which realistically lowers reliability below what the 7.2 base score implies. Exploitation is also gated to a specific deployment shape: Gateway deployments using identity-bearing authentication modes with narrower operator scopes; shared-secret token and password callers are explicitly out of scope as fully trusted operators. Net: a legitimate authorization-boundary flaw worth patching for anyone running multi-tenant/identity-scoped Gateway setups, but it is not a high-urgency mass-exploitation issue - it is a niche, config-dependent privilege-escalation with no evidence of exploitation.

In an OpenClaw Gateway configured with identity-bearing auth and per-caller operator scopes, a write-scoped non-owner user submits a chat.send request and steers the agent turn so its tool inventory includes the owner-only gateway and cron tools. The model then invokes owner-only configuration or scheduling operations, applying persistent state changes the caller was never authorized to make. No public exploit code is available and success depends on the model actually selecting the exposed tools.