Openclaw cli: OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes (CVE-2026-45006)

The OpenClaw CLI's agent-facing gateway tool protects config.apply and config.patch operations with a model-to-operator trust boundary enforced by a denylist of protected config paths. The config schema expanded beyond this denylist, leaving sensitive subtrees writable through model-driven gateway config mutations. A compromised or prompt-injected model with access to the owner-only gateway tool could persist unsafe config changes crossing security boundaries, including command execution, network/proxy/TLS behavior, credential forwarding, telemetry, hook endpoints, memory/indexing surfaces, and operator policy controls. These unsafe changes persist across restarts. The vulnerability affects openclaw versions >=2026.1.29 and <2026.4.23. The fix, committed in bceda6089aa7b3695cc7696b43c61ae3d01bb0ec and released in [email protected], replaces the denylist with a fail-closed allowlist that permits only narrow agent-tunable prompt/model settings and mention-gating paths, rejecting other config changes before mutation RPC invocation.

An attacker controlling or influencing the model with access to the owner-only gateway tool can persist unsafe configuration changes that cross security boundaries. These changes can affect critical areas such as command execution, network and proxy settings, TLS behavior, credential forwarding, telemetry, hook endpoints, memory and indexing surfaces, and operator policy controls. The unsafe configurations persist after restarts, potentially leading to unauthorized command execution, data exposure, or policy bypass. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.

A patch is available in openclaw version 2026.4.23 that replaces the insecure denylist with a fail-closed allowlist, restricting config.apply and config.patch operations to a narrow set of safe, agent-tunable prompt/model settings and mention-gating paths. Users should upgrade to version 2026.4.23 or later to mitigate this vulnerability. No additional mitigation is required beyond applying the official fix.