OpenClaw versions before 2026.6.8 have an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides. This flaw allows lower-trust callers to perform actions that normally require stronger authorization. Exploitation involves misconfigured input paths that bypass admin authorization policies and enable execution of restricted operations.