OpenClaw versions before 2026.6.9 contain a privilege escalation vulnerability in the plugin install commands. This flaw allows lower-trust callers to execute or persist actions beyond their intended authorization by exploiting misconfigured input paths or enabled features. The vulnerability enables attackers to escalate privileges and perform unauthorized actions when the vulnerable feature is reachable.