OpenClaw CVE-2026-43568

Requires authenticated network access with operator.write scope credentials to an OpenClaw gateway instance running vulnerable versions 2026.4.5 through 2026.4.9. Specifically, the attacker must possess valid gateway client credentials with write scope but not admin scope-environments using only admin-scoped accounts or unauthenticated access are not exploitable via this path. The /dreaming endpoint must be accessible to the authenticated session (not blocked by external firewall/proxy rules). Exploitation occurs against default configurations where write-scoped operators can reach the endpoint; no special feature enablement required beyond standard gateway operation. User interaction is not required (UI:N). Limiting factors: network accessibility to the gateway (typically requires internal network or VPN access in production deployments), credential theft or insider threat prerequisite, and deployment model (single-tenant instances with unified privilege levels face lower risk than multi-tenant or role-separated environments).

Real-world risk is moderate and context-dependent. CVSS 7.1 (High) reflects network accessibility, low complexity (AV:N/AC:L), and high integrity impact (VI:H), but exploitation requires authenticated credentials (PR:L). The attack cannot be automated against arbitrary targets-attackers must first obtain legitimate write-scoped gateway credentials, limiting opportunistic mass exploitation. EPSS data not provided, but the specificity of required context (authenticated gateway access to an npm-distributed AI platform) suggests low widespread exploitation probability. No CISA KEV listing confirms this is not yet exploited at scale. The GitHub Security Advisory (GHSA-5gjc-grvm-m88j) and commit 6af17b39 confirm both the vulnerability details and patch availability. Primary risk applies to multi-tenant OpenClaw deployments where write-scoped operators should not control admin-class settings-single-tenant or tightly controlled environments face lower practical risk. The 'Authentication Bypass' tag is somewhat misleading; this is privilege escalation within an authenticated session, not authentication bypass. Prioritize patching in environments where operator roles are segregated and untrusted users hold write credentials.

An attacker with compromised or insider write-scoped gateway credentials (operator.write) authenticates to the OpenClaw gateway and sends a crafted request to the /dreaming endpoint with a toggle command (e.g., POST /dreaming with 'on' or 'off' parameter). The vulnerable handler in dreaming-command.ts processes the request without validating gatewayClientScopes, allowing the write-scoped session to persist admin-class configuration changes. The attacker escalates to admin-level control over memory dreaming settings, potentially enabling data persistence manipulation, configuration tampering, or further privilege escalation via modified dreaming behavior. No public exploit code identified at time of analysis, but the GitHub commit diff provides clear implementation details for proof-of-concept development.