Openclaw cli: OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write` (CVE-2026-42429)

The OpenClaw CLI's gateway plugin HTTP authentication ('auth: gateway') improperly widens identity-bearing operator.read requests into operator.write permissions at runtime. This means that plugin HTTP routes using gateway authentication could receive runtime write scopes even when the upstream trusted-proxy request only declared read permissions. This flaw affects the openclaw npm package versions >=2026.1.29 and <2026.4.8. The vulnerability was fixed in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 and released in version 2026.4.8. Verification included targeted regression tests to ensure the security boundary was restored.

An attacker or user with operator.read permissions could gain elevated operator.write permissions at runtime via the gateway plugin HTTP routes, potentially allowing unauthorized modification of runtime state. The vulnerability impacts confidentiality and integrity but not availability. The issue is limited to the OpenClaw trust model and does not affect multi-tenant service boundaries.

A patch is available in openclaw npm package version 2026.4.8. Users should upgrade to this version or later to remediate the vulnerability. The fix has been verified with regression tests. No additional mitigation actions are required beyond applying the official fix.