Peng Zhou

An issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. This flaw is network-exploitable and requires no authentication.

An issue exists where missing validation occurs between the phone number provided during login and the phone number verified via One-Time Password (OTP) in the session. This flaw allows session token reuse across different accounts, enabling authenticated attackers with subscriber-level access or higher to log in as any user, including administrators, without knowing the password. This is achieved by providing an arbitrary username after completing the OTP verification for a different phone number.

An issue exists in the `get signed cookie()` function within `django.http.HttpRequest`. The function employs a non-injective salt derivation by concatenating the cookie name and the salt argument. This allows a remote attacker to use a cookie in a context different from its original signing context by utilizing distinct `name` and `salt` pairs that result in the same concatenated string.

Improper neutralization of input during web page generation allows DOM-Based Cross-site Scripting (XSS), a flaw where the application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, typically by writing the data to a Document Object Model (DOM) element.

An incorrect privilege assignment issue allows for privilege escalation within the software.

An issue involving the insertion of sensitive information into sent data allows for the retrieval of embedded sensitive data.

An issue allows write-scoped operators to modify persistent memory dreaming settings. Attackers with write-scoped gateway access can toggle admin-class configuration mutations through the '/dreaming' endpoint to escalate privileges.

An authentication bypass allows untrusted workspace plugins to be automatically enabled during non-interactive onboarding when provider authentication choices are shadowed. This occurs because the system could select a provider authentication choice shadowed by an untrusted workspace plugin, enabling the plugin during authentication setup without explicit user consent.

Insufficient access control in the Nostr plugin HTTP profile routes allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with `operator.write` scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.

An authorization bypass exists where gateway 'operator.write' message-tool paths can access Matrix profile persistence, which should require admin-level authority. This occurs due to insufficient access controls, allowing attackers to mutate persistent profile configuration through non-owner message-tool runs.

Authenticated operators with write permissions can escalate privileges to access admin-class Talk Voice configuration persistence. This is possible by exploiting the 'chat.send' endpoint to reach and modify sensitive voice configuration settings intended exclusively for administrators.

Insufficient access controls allow authenticated operators with write permissions to perform privilege escalation. By utilizing the 'send' endpoint, attackers with `operator.write` credentials can access administrative Telegram configuration and cron persistence settings, enabling the modification of persistence mechanisms.

An improper trust boundary issue exists where untrusted workspace channel shadows can execute during built-in channel setup and login. A malicious workspace plugin claiming a bundled channel id can achieve unintended in-process code execution before the plugin is explicitly trusted, bypassing the intended security boundary during the setup and login process.

Improper authorization checks in the 'chat.send' path allow write-scoped gateway callers to perform admin-only session reset operations. This enables attackers to rotate target sessions, archive previous transcript states, and force the generation of new session IDs without possessing the required admin scope.

The software applies rate limiting only after successful webhook authentication. This allows attackers to bypass rate limits and attempt to brute-force webhook secrets without triggering 429 responses. An attacker can repeatedly guess invalid secrets to discover valid credentials and subsequently submit forged Zalo webhook traffic. The vulnerable component involves the authentication process for webhooks. The `webhook` authentication is affected.

An authorization bypass exists in the 'chat.send' gateway method. The issue occurs because ACP-only provenance fields are gated by self-declared client metadata from the WebSocket handshake instead of a verified authorization state. This allows authenticated operator clients to spoof ACP identity labels and inject reserved provenance fields intended exclusively for the ACP bridge by manipulating client metadata during the connection process.

The software contains a sender allowlist bypass in its Microsoft Teams plugin. This allows unauthorized senders to bypass intended authorization checks. Specifically, when a team/channel route allowlist is configured with an empty `groupAllowFrom` parameter, the message handler creates wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.

A privilege escalation issue exists in the "chat.send" endpoint. Write-scoped gateway callers can persist admin-only `verboseLevel` session overrides by exploiting the `/verbose` parameter. This allows attackers to bypass access controls and expose sensitive reasoning or tool output that should be restricted to administrators.

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.24 Description OpenClaw contains an authorization bypass issue in the HTTP '/v1/models' endpoint. The endpoint does not enforce operator read scope requirements, allowing attackers with only 'operator.approvals' scope to enumerate gateway model metadata. This bypasses the stricter WebSocket RPC authorization checks. The HTTP compatibility route allows access to model metadata without the necessary 'operator.read' scope, creating an inconsistency between the WebSocket RPC and HTTP surfaces. Recommendations Update to version 2026.3.24 or later.

OpenClaw versions before 2026.3.24 contain a privilege escalation issue. The `/allowlist` command does not properly re-validate gateway client scopes for internal callers, allowing clients with `operator.write` scope to modify channel authorization policies. An attacker can leverage `chat.send` to create an internal command-authorized context and persistently alter channel `allowFrom` and `groupAllowFrom` policies, which are normally restricted to `operator.admin` scope. The vulnerability arises because the `/allowlist` command persists channel authorization configuration through `writeConfigFile()` without enforcing the necessary `operator.admin` scope check for internal gateway callers, unlike `/config` and `/plugins` commands. This allows a client authenticated with `operator.write` to indirectly modify channel authorization state, weakening the control-plane privilege separation.