PT-2026-35807

CVE-2026-42429

Published

2026-04-09

Updated

2026-04-28

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description A privilege escalation issue exists in the gateway plugin HTTP authentication mechanism. This flaw allows identity-bearing operator.read requests to be widened into runtime operator.write permissions. An attacker can exploit this by sending read-scoped requests through the gateway auth route to obtain unauthorized write access to runtime operations.

Recommendations Update to version 2026.4.8 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Smaeljaish771

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management