Openclaw cli: OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope (CVE-2026-35619)

The OpenClaw CLI has a cross-surface authorization inconsistency (CVE-2026-35619) where the HTTP /v1/models route does not enforce the operator.read scope required for listing models, unlike the WebSocket RPC path which enforces this scope. Operators with only operator.approvals scope can successfully fetch model metadata via HTTP /v1/models despite being denied access over WebSocket RPC. This bypass breaks scope consistency and least-privilege expectations. The vulnerability affects versions >=2026.1.29 and <2026.3.24 and was fixed in 2026.3.24 by enforcing scope checks on HTTP endpoints and reusing centralized authorization logic.

Operators lacking the operator.read scope can enumerate gateway model metadata through the HTTP /v1/models endpoint, bypassing intended access restrictions. This breaks the consistency of scope enforcement between WebSocket and HTTP interfaces, weakening the security model and potentially exposing sensitive model metadata to unauthorized operators. There is no indication of impact beyond information disclosure of model metadata. No known exploits in the wild have been reported.

A fix is available in OpenClaw version 2026.3.24. Operators should upgrade to this version or later to ensure that the HTTP /v1/models endpoint enforces the operator.read scope consistently with the WebSocket RPC path. The patch applies centralized scope authorization logic to HTTP routes to prevent this bypass. No additional mitigation actions are required beyond applying the official fix.