A critical authorization bypass vulnerability in OpenClaw allows authenticated attackers to perform unauthorized actions, necessitating an immediate update.

This vulnerability (CWE-863) stems from an incorrect authorization check within the chat send route, permitting authenticated users to access functions outside their designated scope.

The exploit allows for unauthorized command execution or data manipulation within the application context, potentially leading to full compromise of the affected service. With a CVSS score of 8.8, this flaw represents a significant risk to data integrity and system security, as it bypasses intended access control mechanisms.

Immediate Action: Update the OpenClaw package to version 2026.5.18 or later via your package manager (e.g., npm).

Proactive Monitoring: Audit application logs for unusual chat activity or requests to administrative routes originating from standard user accounts.

Compensating Controls: Implement strict network-level access controls to limit the exposure of the application's internal API routes to trusted networks only.

Public Exploit Available: No (Exploit available: false)

Given the high CVSS severity and the potential for unauthorized privilege escalation, administrators must prioritize upgrading to version 2026.5.18. Regular maintenance of the OpenClaw dependency tree is recommended to ensure such authorization flaws are mitigated promptly.