PT-2026-31773

CVE-2026-35638

Published

2026-03-26

Updated

2026-04-12

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description OpenClaw contains a privilege escalation issue in the Control UI. Unauthenticated sessions can retain self-declared privileged scopes without device identity verification. Attackers can exploit the trusted-proxy mechanism's device-less allow path to maintain elevated permissions by declaring arbitrary scopes, bypassing device identity requirements.

Recommendations Update to version 2026.3.22 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Nathan

Vendors

Affected products

Weakness enumeration

CWE-286: Incorrect User Management