CVE-2026-35625

HIGH

OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-fqw4-mph7-2vr8)
https://github.com/openclaw/openclaw/security/advisories/GHSA-fqw4-mph7-2vr8
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect
https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-silent-local-shared-auth-reconnect

Scores

CVSS v3 7.8
EPSS 0.0019
EPSS Percentile 9.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-648
Status published
Products (3)
OpenClaw/OpenClaw < 2026.3.25
openclaw/openclaw < 2026.3.25
OpenClaw/OpenClaw 2026.3.25
Published Apr 09, 2026
Tracked Since Apr 10, 2026