PT-2026-31774 · Openclaw · Openclaw
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.22
Description
OpenClaw contains a privilege escalation issue in the
device.pair.approve method. An operator with pairing approval rights can approve device requests with broader operator scopes than authorized. This insufficient scope validation can lead to escalation to operator.admin privileges and potential remote code execution on the Node infrastructure.Recommendations
Update to version 2026.3.22 or later.
Exploit
Fix
LPE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw