CVE-2026-43568: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-43568 is a privilege escalation vulnerability in OpenClaw (npm package) affecting versions 2026.4.5 through 2026.4.9. Authenticated users with write-scoped gateway access can modify persistent memory dreaming settings via the /dreaming endpoint, effectively performing admin-class configuration mutations without the required authorization. The vulnerability was published on May 5, 2026, and a patch was released in version 2026.4.10. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is a missing authorization check (CWE-862) on the /dreaming endpoint, compounded by incorrect privilege assignment (CWE-266) and incorrect authorization (CWE-863). Specifically, the gateway dispatch path passed client?.connect?.scopes directly without a null/undefined fallback, meaning absent scopes were treated as permissive rather than unprivileged — allowing write-scoped (operator.write) callers to invoke persistent dreaming configuration toggles that should require operator.admin scope. The fix introduced a requiresAdminToMutateDreaming() guard that checks for the presence of operator.admin in gatewayClientScopes, and normalizes missing scopes to an empty array (scopes ?? []) before dispatch (GitHub Commit, GitHub Advisory).

Successful exploitation allows any authenticated user with write-scoped gateway access to escalate their privileges to admin-class level by toggling persistent memory dreaming configuration through the /dreaming on|off command. The primary impact is on integrity — unauthorized modification of admin-class configuration settings — with no direct confidentiality or availability impact per the CVSS scoring. In environments where dreaming/memory configuration controls sensitive AI behavior or data retention policies, unauthorized modification could have downstream operational consequences (GitHub Advisory, Feedly).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.025% (0.000250), indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access with at least operator.write scope, limiting the attack surface to users who already have some level of authorized access. It has not been added to the CISA KEV catalog (Feedly, GitHub Advisory).

1. Obtain write-scoped access: Authenticate to the OpenClaw gateway with credentials that carry operator.write scope — this may be a legitimate operator account or compromised credentials.
2. Identify the vulnerable endpoint: Confirm the target is running OpenClaw npm package version >= 2026.4.5 and < 2026.4.10 by inspecting version metadata or API responses.
3. Send a /dreaming toggle command: Issue a gateway request to the /dreaming endpoint with the on or off argument (e.g., /dreaming on) using the write-scoped client connection. In unpatched versions, the missing scope check allows this to proceed.
4. Achieve persistent config mutation: The command handler calls writeConfigFile() with the updated dreaming configuration, persisting an admin-class setting change without requiring operator.admin scope.
5. Leverage escalated configuration: Depending on the deployment, the modified dreaming/memory settings may alter AI memory retention behavior, potentially enabling further information gathering or operational manipulation (GitHub Commit, GitHub Advisory).

• Logs: Gateway access logs showing /dreaming on or /dreaming off commands issued by clients authenticated with operator.write scope (not operator.admin); unexpected writeConfigFile calls in application logs from non-admin gateway clients.
• File System: Unexpected or unauthorized changes to the OpenClaw configuration file reflecting modified dreaming/memory settings (e.g., enabled: true or enabled: false toggled without admin action).
• Application Behavior: Dreaming/memory persistence settings changing without corresponding admin-level activity in audit trails; configuration file modification timestamps inconsistent with known admin operations.

Upgrade OpenClaw to version 2026.4.10 or later; the latest npm release 2026.4.14 also includes the fix. The patch (commit 6af17b3, PR #63872) enforces operator.admin scope for all persistent /dreaming on|off gateway toggles and normalizes missing client scopes to an empty array. As a temporary workaround, restrict network access to the /dreaming endpoint to trusted systems only, and audit gateway client scope assignments to ensure operator.write accounts do not have unintended access to configuration-modifying endpoints (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researchers @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer, and was credited in the official GitHub Security Advisory. The advisory was published by @steipete on April 16, 2026, and the fix was authored by @mbelinky. No significant broader media coverage or notable community controversy has been observed beyond standard CVE aggregator pickup (GitHub Advisory).