PT-2026-31974 · Openclaw · Openclaw
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.25
Description
The OpenClaw gateway backend contains a privilege escalation issue. Non-admin operators can bypass pairing requirements and self-request broader scopes during backend reconnect, potentially gaining unauthorized administrative privileges by reconnecting as
operator.admin.Recommendations
Update to version 2026.3.25 or later.
Exploit
Fix
LPE
Improper Privilege Management
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw