Openclaw cli: OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval

OpenClaw Gateway exposes an authenticated HTTP endpoint intended for invoking a constrained set of tools. Two issues combined to increase risk: (1) the gateway did not deny high-risk session orchestration tools by default, allowing authenticated callers to invoke tools like sessions_spawn and sessions_send, enabling session creation/control and cross-session message injection; (2) ACP clients auto-approved permission requests for risky tools with insufficient user interaction, reducing friction against silent execution or mutation. The vulnerability has a CVSS 3.1 score of 8.8 and affects OpenClaw versions before 2026.2.14. The fix, introduced in 2026.2.14, denies high-risk tools by default, hardens ACP permission handling, and requires explicit user prompts for non-read/search permissions.

An attacker with valid Gateway authentication token on a reachable Gateway can escalate privileges from invoking single tools to spawning and controlling agent sessions, potentially achieving command execution depending on environment and policies. They can also perform cross-session message injection and obtain unintended permission approvals in ACP-integrated setups, leading to high confidentiality, integrity, and availability impacts.

A fix is available in OpenClaw version 2026.2.14 and later, which hardens default behavior by denying high-risk tools over the HTTP /tools/invoke endpoint and enforcing stricter ACP permission prompts. Deployments should keep the Gateway bound to loopback interfaces to prevent public exposure, avoid exposing the Gateway directly to the internet, and treat enabling default-denied HTTP tools as high-risk, auditing such configurations carefully.