CVE-2026-35625

HIGH

OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect

Title source: cna

Description

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.

References (3)

[Third Party Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-fqw4-mph7-2vr8

[Patch] https://github.com/openclaw/openclaw/commit/81ebc7e0344fd19c85778e883bad45e2da972229

View Patch ZIP pw:eip

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-silent-local-shared-auth-reconnect

Scores

CVSS v3 7.8

EPSS 0.0004

EPSS Percentile 13.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-648

Status published

Products (3)

OpenClaw/OpenClaw < 2026.3.25

openclaw/openclaw < 2026.3.25

OpenClaw/OpenClaw 2026.3.25

Published Apr 09, 2026

Tracked Since Apr 10, 2026