Incorrect authorization in OpenClaw - #VU135875
Published: June 30, 2026
Vulnerability identifier: #VU135875
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: OpenClaw
Affected software:
OpenClaw
OpenClaw
Detailed vulnerability description
The vulnerability allows a remote user to bypass install policy and execute or persist actions beyond the caller's intended authorization.
The vulnerability exists due to incorrect authorization in plugin install wrappers when handling plugin installation through the affected feature and configuration. A remote privileged user can invoke a lower-trust caller or configured input path to bypass install policy and execute or persist actions beyond the caller's intended authorization.
Only instances where the affected feature is enabled and reachable are vulnerable, and practical impact depends on whether lower-trust input can reach that path.
Remediation
Install security update from vendor's website.