Whyiug

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.5.10-beta.1 through 2026.6.4 **Description** An authorization bypass exists in the ClickClack agent-mode dispatch feature. This issue allows the system to ignore the `toolsAllow` policy check. If the affected feature is enabled and reachable, a lower-trust caller or a configured input path can execute actions that normally require stronger authorization or policy verification. **Recommendations** Update OpenClaw to version 2026.6.5 or later. As a temporary mitigation, disable the ClickClack agent-mode dispatch feature to prevent unauthorized actions.