Summary
OpenClaw incorrectly trusts a requester identifier supplied in certain message.action requests, allowing a write-scoped caller to appear as another sender during channel authorization. In identity-bearing Gateway deployments, this may permit unauthorized channel operations that the actual caller would not be allowed to perform.
Affected context
The vulnerability occurs in OpenClaw Gateway deployments that use authentication modes preserving caller identity and enforcing narrower operator scopes. It is relevant when message.action requests reach channel authorization checks and the selected channel action relies on the requester's identity. Shared-secret token and password callers, which are treated as fully trusted operators by OpenClaw's security model, are outside the described scope.
Exploit preconditions
- Attack surface: OpenClaw Gateway message.action handling and channel authorization - Required access: A write-scoped identity-bearing caller able to submit message.action requests - Trigger point: Channel authorization of an action using requester provenance - Why exploitation is possible: The authorization logic accepts a caller-supplied sender identifier instead of reliably binding authorization to the authenticated requester
Why this happens
The underlying bug is an authorization decision based on user-controlled identity data. When a system uses a supplied sender identifier as the authorization subject without cryptographically or structurally binding it to the authenticated caller, a lower-privileged requester may be evaluated as another identity. This maps to CWE-639, Authorization Bypass Through User-Controlled Key, because attacker-influenced identity selection affects access-control decisions.
Potential impact
- A caller may invoke channel actions that would otherwise be denied
- Unauthorized messages or account operations could be performed
- Sensitive channel capabilities may be exposed or misused
- The effective permissions of another sender could be improperly exercised
- Impact may extend to connected accounts depending on channel configuration and permissions
General mitigation guidance
Mitigation generally focuses on deriving authorization identity from the authenticated security context rather than request fields. Channel actions can use server-controlled subject binding, explicit allowlists, and action-specific authorization checks. Sensitive actions may be restricted to administrators, while unnecessary identity-dependent channel actions can be disabled. Input trust should be reduced through strict schemas and provenance validation, and Gateway processes should operate with the least privilege needed for their configured channels.
How teams detect issues like this
Detection approaches include static analysis and code review checks for authorization decisions that use request-provided user, sender, or account identifiers. Reviewers can trace whether the identity used by each channel permission check originates from the authenticated session and whether identity-bearing fields are immutable or independently verified. Runtime policy enforcement can alert on write-scoped callers requesting sensitive actions, unexpected identity changes, and authorization subjects that differ from authenticated principals. Automated security review tools may help flag these patterns in Gateway handlers and adapters.
