Summary
OpenClaw fails to enforce that Claude Code permission prompts delivered through its MCP channel bridge can be handled only by the owner. An authorized non-owner channel sender with command access may approve or deny a pending request, allowing an action to proceed without the owner's consent.
Affected context
The vulnerability occurs in OpenClaw deployments that use the MCP channel bridge to deliver Claude Code permission prompts. It becomes risky when a non-owner sender is authorized to issue channel commands and can interact with a pending permission request intended for the owner.
Exploit preconditions
- Attack surface: OpenClaw's MCP channel bridge and its permission-prompt handling
- Required access: Authorization to send commands through an integrated channel, but not owner-level authorization
- Trigger point: A pending Claude Code permission request awaiting an owner decision
- Why exploitation is possible: The bridge does not reliably enforce the owner-only requirement before accepting an approval or denial from an authorized non-owner sender
Why this happens
The underlying issue is an authorization-enforcement failure. The MCP channel bridge treats channel-level command authorization as sufficient for responding to permission prompts that require owner approval, rather than independently verifying the sender's ownership privileges. This behavior maps to CWE-862: Missing Authorization, where a protected operation lacks an effective access-control check.
Potential impact
- A non-owner channel sender may approve an action without owner consent
- Sensitive or privileged Claude Code operations could proceed
- Host resources, files, or commands may be accessed depending on the requested action
- Security policy and workflow approvals could be bypassed
- An attacker could cause unintended changes or operational disruption
General mitigation guidance
Mitigation generally focuses on making authorization decisions explicit, independent, and fail-closed.
Common defensive patterns include:
- Enforcing owner-only authorization at the permission-prompt decision point
- Separating channel command privileges from approval privileges
- Binding each permission request to the intended approver and request context
- Defaulting ambiguous, expired, or unverifiable decisions to denial
- Minimizing the host capabilities available to Claude Code runs
- Applying least privilege to channel integrations and service identities
- Reducing trust in sender-provided identity or role claims by validating them through a trusted authorization source
How teams detect issues like this
Organizations can look for missing-authorization conditions through:
- Static analysis and code review rules that identify privileged actions without owner or role checks
- Review of permission-prompt handlers for sender identity validation and fail-closed behavior
- Tests that attempt approval and denial operations using authorized non-owner identities
- Audit-log policies that record the requester, intended approver, actual decision maker, and resulting action
- Automated review tools that flag authorization decisions based only on channel membership or command access
