A vulnerability in OpenClaw's scoped Gateway chat.send route allows commands requiring higher privileges (operator.approvals or operator.admin) to be executed with only operator.write scope when routed through inherited external delivery routes. This affects deployments where scoped Gateway clients with operator.write can deliver commands into sessions with external routes. The issue is fixed in version 2026.5.18. Until upgraded, avoid granting operator.write tokens to clients that can deliver commands into sessions with external routes unless fully trusted.