OpenClaw Codex computer-use install authorization bypass: non-owners could install plugins and run processes on the host

Who is affected

To be exploited, the channel also needs a sender who is authorized, has command access, but is not the owner. CVSS rates the privileges required as Low, so this is not an attack a stranger can launch without logging in. Our analysis: because the vendor’s workaround is to disable installation in message channels, the risk exists when the install command can be triggered from message channels.

No source says which version first added the vulnerable command; the “0” start of the range in the CNA and OSV data just means “all earlier versions.”

On the exact range: the vendor advisory and the CVE record say “below 2026.7.1” in semver terms, and the vendor calls 2026.7.1 “the first stable patched version”. By semver, the 2026.7.1 beta pre-releases (npm has beta.1, beta.2 and beta.4 to beta.6, but no beta.3) and 2026.7.1-1 and 2026.7.1-2 (published 2026-07-18, after the stable release) are all below 2026.7.1 and fall inside that range; OSV also lists v2026.7.1-beta.3 to beta.6 as affected. Git history tells a different story: GitHub’s comparison shows that e87b0df, the merge commit of PR #97955 (2026-06-30, which PlainCVE judges to be the fix), is an ancestor of every beta tag from v2026.7.1-beta.1 on, and v2026.7.1-1 and v2026.7.1-2 are 8 and 9 commits ahead of v2026.7.1 and 0 behind, so they fully contain it. In other words, the code in these versions already has the fix, but their version numbers fall inside the vendor’s range and the vendor says nothing about them.

npm also has 2026.6.33 to 2026.6.35 (published 2026-07-21 to 2026-09-10): released later than 2026.7.1 but numbered lower, so by semver they are also “below 2026.7.1”. According to GitHub’s comparison, these three tags are on a release line that branched off before the fix and don’t contain e87b0df; we also looked at the Codex command handler in those tags, and it lacks the install permission check PR #97955 added. Readers on that line should not go by the release date and should move to 2026.7.1 stable or later.

How it works

OpenClaw has a Codex computer-use install command for installing Codex plugins. Once a plugin is installed, its configured MCP process (MCP is a protocol that lets AI call external tools; here it means a program the plugin starts) runs on the OpenClaw host with the OpenClaw user’s privileges.

The vendor’s advisory is clear on this point: under OpenClaw’s security model, installed plugins are trusted code anyway. What broke was not how plugins run but the check on who may install them. In affected versions, the command could skip confirming that the sender was the owner, so a non-owner with command access could install plugin code of their choosing. This maps to CWE-862 (missing authorization).

The flawed approach (conceptual illustration, not the original source code):

function handleCodexInstall(sender, plugin) {
  if (!sender.hasCommandAccess) return deny();
  // Only checks "can send commands", never "is the owner"
  installPlugin(plugin);
}

The fixed approach:

function handleCodexInstall(sender, plugin) {
  if (!sender.isOwner && !sender.isAdmin) return deny(); // installing trusted code is owner/admin-only
  installPlugin(plugin);
}

Based on comparing content, PlainCVE judges the corresponding fix to be PR #97955 (fix(codex): restrict computer-use installation, merged 2026-06-30); the vendor advisory and the CVE record cite no PR or commit, so this link is not an official statement. The 2026.7.1 release notes list this change: installing or reconfiguring Codex Computer Use resources now requires owner or administrator access, while other authorized senders can still check status; the PR description specifies an owner or a Gateway client with operator.admin.

Timeline

Our analysis: the fixed release came out about two months before the advisory.

Further reading

• Scoring differences: the CNA (VulnCheck) gives CVSS 4.0 8.7; the vendor advisory gives CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and no 4.0 score. NVD has not analyzed it yet (status: Deferred).
• Disclosure date differs: the vendor advisory and the CVE record’s public date are 2026-09-11; TheHackerWire says 2026-09-26, which is actually the CVE record’s publication date. This page uses 2026-09-11.
• Exploitation: no source reports exploitation in the wild, and none rules it out; there’s no information on whether it was exploited before a patch existed. TheHackerWire said no public exploit code had been confirmed at the time. GitHub’s database lists an EPSS probability of about 0.246% (2026-09-28).
• Not this fix: commit 995febb (#69774) also tightened owner checks for owner-only commands, but no source links it to this CVE, and its changelog entry sits above the 2026.4.20 section, before 2026.7.1. This page doesn’t treat it as the fix.
• The vendor advisory itself lists no CVE ID; the CNA (VulnCheck) linked it in the CVE record. The GitHub Advisory Database entry GHSA-w2h4-w48g-f6hp has not been reviewed yet.
• Reported by GitHub user wwwvwwvwwwwwvwwvw.