OpenClaw's gateway tool had a vulnerability where its config mutation guard relied on a denylist that became outdated as the config schema expanded. This allowed unsafe model-driven config writes to sensitive configuration paths, potentially crossing security boundaries. A compromised model with access to the owner-only gateway tool could persist dangerous config changes affecting command execution, network behavior, credentials, telemetry, and operator policies. The issue was fixed in version 2026.4.23 by replacing the denylist with a fail-closed allowlist that restricts config changes to narrow, safe settings only.