Openclaw cli: OpenClaw authorization bypass: operator.write can resolve exec approvals via chat.send -> /approve (CVE-2026-28473)

OpenClaw CLI contains an authorization bypass (CVE-2026-28473) where a client authenticated with a device token scoped only to 'operator.write' can approve or deny pending exec approval requests by sending the '/approve' chat command. Although direct RPC calls to 'exec.approval.resolve' require 'operator.approvals' scope, the chat command internally invokes this function via a privileged gateway client without enforcing the same scope. This allows clients without 'operator.approvals' permission to resolve exec approvals improperly. The vulnerability affects openclaw npm package versions prior to 2026.2.2. The issue is fixed in version 2026.2.2 by requiring the requesting client to have 'operator.approvals' or 'operator.admin' permissions when invoking '/approve' from gateway clients.

Clients with 'operator.write' permission but without 'operator.approvals' can improperly approve or deny exec requests, potentially allowing unauthorized execution control in multi-client or shared token environments. This could lead to unauthorized command execution approvals, impacting confidentiality, integrity, and availability of the system.

A fix is available in openclaw version 2026.2.2. Users should upgrade to this version to resolve the vulnerability. If upgrading is not immediately possible, avoid issuing write-only device tokens to untrusted clients, disable text commands by setting 'commands.text=false', or restrict access to the webchat/control UI to trusted users only.