CVE-2026-35674: OpenClaw < 2026.5.18 - Scope Bypass via Inherited chat.send Route

Synopsis

OpenClaw before 2026.5.18 has a scope bypass vulnerability in the Gateway chat.send route. An attacker with a low-privilege operator.write token can reach the route over the network and route privileged commands through inherited external routes, bypassing the operator.approvals and operator.admin scope checks. Successful exploitation lets the attacker mutate plugins, configuration, MCP settings, allowlists, and ACP rules without proper authorization. A patched-image rebuild at 2026.5.18 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenClaw Gateway chat.send route over the network.

• AuthenticationRequired

  A low-privilege token with operator.write scope is sufficient; no admin or approvals scope is required to trigger the bypass.

• Victim interactionNot required

  The attack runs against the Gateway directly with no user action involved.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and has no environmental preconditions once a scoped token is held.

Blast Radius

• Mutates plugin configuration, loading or altering code paths executed by the Gateway.
• Modifies server configuration, MCP settings, allowlists, and ACP rules that govern trust and access.
• Effectively escalates an operator.write token to full operator.admin authority, undermining the approvals workflow.