N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jr6x-2q95-fh2g

GHSA-jr6x-2q95-fh2g: OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools

Summary

An authorization mismatch allowed authenticated callers with operator.write access to invoke owner-only tool surfaces (gateway, cron) through agent runs in scoped-token deployments.

Impact

On affected deployments, write-scoped callers could perform control-plane actions beyond intended write scope.

Fix

Owner-only gating is now enforced consistently for owner-only tool surfaces during agent execution, and tool scope classification was tightened to remove the privilege mismatch.

Affected and Patched Versions

Affected: <= 2026.2.26
Patched: 2026.3.1

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jr6x-2q95-fh2g

GHSA-jr6x-2q95-fh2g:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.3.1	2026.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an authorization mismatch where OpenClaw's gateway did not correctly differentiate between write-scoped (operator.write) and admin-scoped (operator.admin) tokens for agent runs. This allowed authenticated users with only write permissions to access and execute owner-only tools, leading to privilege escalation.

The analysis of the security patch (commit 58659b931b823397cae9884292a05ba9d4ad97af) reveals the root cause and the fix. The core of the vulnerability was in the agent:run handler within src/gateway/server-methods/agent.ts, which failed to verify if the caller was a true owner. Deeper in the call stack, the runAgentAttempt function in src/commands/agent.ts unconditionally executed agent runs with owner privileges by hardcoding a senderIsOwner flag to true.

The fix introduces a senderIsOwner flag that is now determined by checking for the operator.admin scope in the caller's token. This flag is propagated from the gateway's agent:run handler down to the runAgentAttempt function, ensuring that only callers with the appropriate administrative privileges can execute owner-only tools. Additional hardening was applied to other paths that can trigger agent runs, such as handleNodeEvent, to explicitly set senderIsOwner to false, further securing the system against this type of privilege escalation.

Vulnerable functions

agent:run

src/gateway/server-methods/agent.ts

This gateway method handles agent execution requests. The vulnerability existed because this function did not properly check if the authenticated caller had owner-level privileges (`operator.admin` scope), defaulting to a privileged context. This allowed callers with only `operator.write` scope to execute owner-only tools. The patch introduces a check to verify the caller's scope and sets a `senderIsOwner` flag accordingly.

runAgentAttempt

src/commands/agent.ts

This function is part of the agent execution flow. It was vulnerable because it previously hardcoded `senderIsOwner` to `true`, effectively running all agent attempts with owner privileges, regardless of the initial caller's scope. The patch modifies it to respect the `senderIsOwner` flag passed down from the gateway.

handleNodeEvent

src/gateway/server-node-events.ts

This function handles events from nodes and can trigger agent runs. It was modified as part of the security hardening to explicitly set `senderIsOwner` to `false`. This ensures that agent runs originating from node events are not executed with owner privileges, preventing potential privilege escalation through this vector.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.