Junglewise Threat Intelligence

OpenClaw privilege escalation in device.pair.approve

Severity: high · CVSS 8.8 · Published 2026-04-10

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a gateway and infrastructure management tool. A security flaw in the device pairing process allows users with limited 'pairing' permissions to grant themselves or others full administrative access. This could allow an attacker to take complete control of the underlying server infrastructure and execute arbitrary commands.

Technical details

A privilege escalation vulnerability exists in OpenClaw's 'device.pair.approve' method due to insufficient scope validation (CWE-648/CWE-269). An attacker with 'operator.pairing' privileges can approve pending device requests with broader scopes than they actually possess, such as 'operator.admin'. By escalating to administrative privileges, the attacker can achieve remote code execution (RCE) on the Node.js infrastructure. The fix, introduced in version 2026.3.22, ensures that requested operator scopes are validated against the approver's own held scopes.

Affected products

  • OpenClaw openclaw < 2026.3.22

Timeline

  • 2026-03-15: patched: Fix commit fc2d29e authored
  • 2026-03-24: advisory: Original internal advisory GHSA-hf68-49fm-59cq published
  • 2026-04-09: disclosed: CVE-2026-35639 published to NVD
  • 2026-04-10: advisory: Duplicate advisory GHSA-r3v5-2grc-429h published and withdrawn

References

Related threats