# OpenClaw: `operator.write` chat.send could reach…

📦

📦 npm

Not in CISA KEV

MEDIUM severity

# OpenClaw: \`operator.write\` chat.send could reach admin-only config writesGHSA-hfpr-jhpq-x4rm

MEDIUM [Fix: openclaw/openclaw@5f8f58a](https://github.com/openclaw/openclaw/commit/5f8f58ae25e2a78f31b06edcf26532d634ca554e)

GHSA-hfpr-jhpq-x4rm is a medium-severity (CVSS 4.3) vulnerability in openclaw. A fix is available for openclaw — see the affected versions and patch details below.

Published

Mar 9, 2026

Updated

Mar 9, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Mar 9, 2026 · OSV.dev, FIRST.org (EPSS)

## Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

132other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

`openclaw`npm

3.4Mdownloads / week

## Description

#### Summary

A gateway client authenticated with `operator.write` could route `/config set` or `/config unset` through `chat.send` and reach persistent config mutation even though direct config RPC methods are admin-scoped.

#### Affected Packages / Versions

-   Package: `openclaw` (npm)
-   Latest published vulnerable version: `2026.3.2`
-   Affected range: `<= 2026.3.2`
-   Patched in: `2026.3.7`

#### Details

Before the fix, `chat.send` ran slash commands in an internal gateway-chat context with `CommandAuthorized: true`, and `/config` write paths only checked command authorization plus `commands.config` / `channels.<provider>.configWrites` gates. That allowed an authenticated `operator.write` gateway client to bridge into persistent config writes even though direct `config.*` RPC methods remain `operator.admin` scoped.

The fix keeps command functionality intact while restoring the intended scope boundary:

-   persistent `/config set|unset` writes routed through gateway `chat.send` now require `operator.admin`
-   read-only `/config show` remains available to normal write-scoped gateway clients
-   normal messaging-channel `/config` behavior remains unchanged

#### Impact

This is a real authorization mismatch, but exploitability requires an already authenticated gateway client with `operator.write`, `chat.send` access, and `/config` command support enabled. Maintainer severity is set to medium because the bug is a scoped control-plane privilege mismatch rather than a broad unauthenticated or generic remote compromise. The main consequence is unintended persistent config mutation.

#### Fix Commit(s)

-   `5f8f58ae25e2a78f31b06edcf26532d634ca554e`

#### Release Process Note

npm `2026.3.7` was published on March 8, 2026. This advisory is fixed in the released package.

Thanks @tdjackey for reporting.

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

📦npm

`openclaw` 

all versions

2026.3.7`npm install openclaw@2026.3.7`

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update openclaw to 2026.3.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hfpr-jhpq-x4rm is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
    

## Frequently Asked Questions

\### Summary A gateway client authenticated with \`operator.write\` could route \`/config set\` or \`/config unset\` through \`chat.send\` and reach persistent config mutation even though direct config RPC methods are admin-scoped. ### Affected Packages / Versions - Package: \`openclaw\` (npm) - Latest published vulnerable version: \`2026.3.2\` - Affected range: \`<= 2026.3.2\` - Patched in: \`2026.3.7\` ### Details Before the fix, \`chat.send\` ran slash commands in an internal gateway-chat context with \`CommandAuthorized: true\`, and \`/config\` write paths only checked command authorization plus \`commands.conf

O3 Security · Impact-Aware SCA

### Is GHSA-hfpr-jhpq-x4rm in your dependencies?

Find it across npm, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)