The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) versions before 2026.9.3 do not enforce the operator.read scope on the authenticated metrics endpoint. In environments using identity-bearing Gateway authentication modes such as trusted-proxy, an authenticated caller whose effective role lacks read scope can still retrieve the diagnostics document. This results in unauthorized disclosure of operational metrics to profiles intentionally limited below read access. Shared-secret Gateway callers, who already have full operator scope, are not affected. The vulnerability is resolved in version 2026.9.3.

Authenticated users with roles lacking the operator.read scope can access operational metrics via the diagnostics-prometheus endpoint, potentially exposing sensitive operational information. This unauthorized access occurs only in deployments using identity-bearing Gateway authentication modes like trusted-proxy. Shared-secret Gateway users are unaffected. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the scope bypass.

A fix is available in OpenClaw diagnostics-prometheus version 2026.9.3. Users should upgrade to this version to resolve the issue. As a workaround, disable the Prometheus endpoint or ensure that all identities able to reach it have the operator.read scope. No other mitigations are indicated.