Openclaw cli: OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates (CVE-2026-35674)

In openclaw-cli versions >=2026.1.29 and <2026.5.18, scoped Gateway clients with operator.write scope could exploit a flaw in the chat.send route inheritance mechanism. Commands that normally require operator.approvals or operator.admin scopes could be executed with only operator.write privileges when delivered through an inherited external route. This affects internal command handlers related to approval resolution and administrative commands including plugin, config, MCP, allowlist, and ACP mutations. The vulnerability does not affect shared-secret bearer HTTP compatibility endpoints. The issue was fixed in openclaw-cli version 2026.5.18.

An attacker or client with operator.write scope could execute commands that require higher privileges (operator.approvals or operator.admin) by leveraging scoped Gateway chat.send requests routed through inherited external delivery paths. This could lead to unauthorized administrative actions such as modifying plugins, configurations, and access control policies, potentially compromising system integrity and control.

Upgrade openclaw-cli to version 2026.5.18 or later, where this vulnerability is patched. Until the upgrade is applied, do not grant operator.write tokens to clients capable of delivering commands into sessions with external routes unless those clients are fully trusted with admin-level command effects.