OpenClaw versions prior to 2026.5.2 have a vulnerability where message.action forwarding can send Gateway credentials to model-supplied loopback URLs. This occurs when model-controlled action metadata selects a loopback Gateway URL, causing the action payload and credentials to be forwarded to that URL. The vulnerability is limited to the named feature and configuration and does not affect the overall trusted-operator model. Exploitation depends on the operator's configuration and whether untrusted input can reach the affected path. The issue is patched in version 2026.5.2.