Summary
OpenClaw contains an authorization bypass in skill tool dispatch that can fail to preserve a sender's owner status. As a result, a non-owner who is authorized to invoke skill commands may reach owner-only tools and access server credentials intended for owners.
Affected context
The issue may affect OpenClaw deployments that use skill commands and distinguish between owner and non-owner senders. It becomes risky when skill dispatch authorizes a command without carrying the sender's ownership context into the tool authorization decision, potentially exposing owner-restricted functionality or credentials.
Exploit preconditions
- Attack surface: OpenClaw skill command and tool-dispatch functionality
- Required access: A non-owner identity authorized to invoke skill commands
- Trigger point: Dispatch of a skill that can reach owner-only tools
- Why exploitation is possible: The dispatch path may omit or fail to propagate the sender's owner status, causing downstream authorization checks to treat a non-owner request as sufficiently privileged
Why this happens
The underlying bug is an authorization-context propagation failure. Skill dispatch does not reliably carry the sender's owner status into the authorization decision for downstream tools, allowing a request with limited command access to cross an owner-only privilege boundary. This maps to CWE-863: Incorrect Authorization, where access-control logic permits an actor to perform an operation outside the actor's intended permissions.
Potential impact
- A non-owner may invoke owner-only tools
- Server credentials reserved for owners could be disclosed
- An attacker could perform privileged administrative actions
- Compromised credentials could enable access to connected services
- The affected deployment could experience data exposure or integrity loss
General mitigation guidance
Mitigation generally focuses on preserving authorization context across every dispatch boundary and enforcing privilege checks at the tool being accessed.
Common defensive patterns include:
- Propagating authenticated identity, ownership, and role claims explicitly through skill dispatch
- Rechecking authorization at the final tool boundary rather than trusting an upstream command decision
- Applying deny-by-default rules to owner-only tools and credential access
- Separating sensitive credentials from general skill execution contexts
- Limiting service permissions and running skill handlers with least privilege
- Treating sender-controlled metadata as untrusted unless it is derived from a trusted authentication layer
How teams detect issues like this
Organizations can assess this class of issue through:
- Static analysis for dispatch functions that drop, overwrite, or reconstruct identity and role metadata
- Code review checks for authorization decisions based on caller-supplied ownership flags
- Tests covering owner, non-owner, unauthenticated, and delegated skill-invocation paths
- Policy enforcement requiring authorization checks at sensitive tool boundaries
- Audit logging that records the authenticated sender, effective role, selected skill, and final tool decision
- Automated security review tools that trace privilege context across command and tool-dispatch flows
