Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

OpenClaw Gateway Tool Configuration Bypass Vulnerability

CVE-2026-45006 · published 5 months ago
Summary

OpenClaw's gateway tool before version 2026.4.23 allows attackers to make unauthorized changes to the tool's configuration. This can lead to malicious behavior, compromised credentials, and unintended network interactions. Update to the latest version of OpenClaw to fix this vulnerability.

Original advisory text
OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configurati...
OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing an incomplete denylist protection. Attackers can persist malicious config modifications affecting command execution, network behavior, credentials, and operator policies that survive restart.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-184Incomplete List of Disallowed Inputs
Timeline
Published11 May 2026
Updated4 Nov 2026
First seen11 May 2026
Sources
CVE-2026-45006 · NVD
Track software like this
Free during beta