Which versions of OpenClaw are affected by CVE-2026-45006?

CVE-2026-45006 affects OpenClaw's gateway tool, allowing authenticated users with model access to persistently alter critical security configurations including command execution policies, network…. A patch is available.

How to fix or mitigate CVE-2026-45006?

Within 24 hours: Identify all OpenClaw deployments and their current versions in your infrastructure. Within 7 days: Upgrade all affected instances to OpenClaw 2026.4.23 or later; test in non-production environment first to validate fail-closed allowlist behavior. Within 30 days: Audit gateway configuration change logs for unauthorized modifications; review and rotate any credentials that could have been exposed through config access; implement access controls limiting model-level permissions to OpenClaw gateways.

OpenClaw CVE-2026-45006

Q: What is the CVSS score of CVE-2026-45006?

CVE-2026-45006 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29151 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-05-11 VulnCheck

GHSA-8wcm-622f-3r46

Authentication Bypass Openclaw

7.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 11, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

May 11, 2026 - 18:22 NVD

8.8 (HIGH) 7.7 (HIGH)

Source Code Evidence Fetched

May 11, 2026 - 17:47 vuln.today

Analysis Generated

May 11, 2026 - 17:47 vuln.today

CVE Published

May 11, 2026 - 16:46 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.23.

DescriptionCVE.org

OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing an incomplete denylist protection. Attackers can persist malicious config modifications affecting command execution, network behavior, credentials, and operator policies that survive restart.

AnalysisAI

Compromised AI models running with access to OpenClaw's gateway tool can persist malicious configuration changes affecting command execution, network endpoints, credentials, and security policies by exploiting an incomplete denylist that failed to protect newly added config paths. The vulnerability allows model-driven writes to sensitive config subtrees (command execution safeguards, proxy/TLS settings, telemetry hooks, operator policies) that survive restart, enabling persistent control beyond the intended model-to-operator trust boundary. Patch available in OpenClaw 2026.4.23 with fail-closed allowlist enforcement. No public exploit or active exploitation confirmed, but CVSS 8.8 (AV:N/AC:L/PR:L) indicates authenticated remote attackers with low-privilege model access can achieve full config compromise.

Technical ContextAI

OpenClaw is an AI agent framework (npm package) that provides models with a 'gateway' tool for runtime configuration mutation. The vulnerability exists in the config.apply and config.patch operations' access control guard, which relied on a hand-maintained denylist of protected config paths. As OpenClaw's config schema expanded, new sensitive paths (tools.exec.safeBins, gateway.remote.url, hooks endpoints, credential forwarding settings, memory/indexing surfaces, operator policy controls) were not added to the denylist, creating exploitable gaps. This is a CWE-184 (Incomplete List of Disallowed Inputs) vulnerability where the security boundary depends on blocking known-bad inputs rather than allowing known-good ones. The affected component is the agent-facing gateway tool RPC layer in the npm package cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* before version 2026.4.23. The fix replaces the denylist with a fail-closed allowlist permitting only narrow agent-tunable paths (prompt/model settings, mention-gating configs like Telegram requireMention) and rejecting all other config mutations before the RPC is invoked.

RemediationAI

Upgrade to OpenClaw 2026.4.23 or later, available via npm (npm install openclaw@2026.4.23 or npm install openclaw@latest). The fix commit bceda6089aa7b3695cc7696b43c61ae3d01bb0ec replaced the incomplete denylist with a fail-closed allowlist that permits only narrow agent-tunable paths (prompt/model settings, mention-gating configs) and rejects all other config mutations before gateway RPC invocation. If immediate upgrade is not possible, compensating controls include: (1) Disable or restrict gateway tool access for models processing untrusted input by removing 'gateway' from the tools.allow list in operator config - this eliminates the attack surface but also disables legitimate model-driven config tuning; (2) Run OpenClaw in read-only config mode if the deployment supports it, preventing all runtime config writes - this breaks dynamic model customization workflows; (3) Deploy models in isolated containers/VMs with separate config stores and restart policies that revert to known-good config on reboot - this limits persistence but does not prevent in-session exploitation. Vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-cwj3-vqpp-pmxr and patch commit at https://github.com/openclaw/openclaw/commit/bceda6089aa7b3695cc7696b43c61ae3d01bb0ec provide additional technical detail.