An authentication bypass vulnerability in OpenClaw allows unauthenticated attackers to execute unauthorized operator-level actions, posing a significant risk to system integrity.

This vulnerability, classified as CWE-862 (Missing Authorization), occurs because unauthenticated plugin-auth HTTP routes incorrectly grant operator runtime write scopes. This allows an unauthenticated attacker to interact with sensitive administrative endpoints that should be restricted to authorized users.

Successful exploitation allows an unauthenticated actor to perform privileged runtime actions, which could lead to unauthorized system modifications or data manipulation. Given the CVSS score of 8.2, this vulnerability is classified as High severity. The ability to perform these actions without prior authentication creates a significant risk of administrative takeover within the affected environment.

Immediate Action: Update the OpenClaw package to version 2026.3.31 or later immediately to resolve the missing authorization flaw.

Proactive Monitoring: Review web server and application access logs for suspicious requests targeting the plugin-auth directory, particularly those originating from unauthorized or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access attempts to the plugin-auth HTTP routes until the software can be patched.

Public Exploit Available: No

The high severity of this vulnerability necessitates immediate action, as it allows for unauthorized privileged actions without any required authentication. Administrators should prioritize upgrading to version 2026.3.31 to eliminate this risk entirely. Failure to patch may expose the system to unauthorized modifications that could compromise the operational integrity of the OpenClaw environment.