PT-2026-28450 · Openclaw · Openclaw

Tdjackey · Published 2026-03-29 · Updated 2026-03-30 · CVE-2026-32922

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description OpenClaw contains a privilege escalation issue within the device.token.rotate function. Callers possessing operator.pairing scope can generate tokens with expanded scopes, bypassing intended scope constraints. This allows attackers to obtain operator.admin tokens for paired devices, potentially leading to remote code execution via system.run or unauthorized gateway-admin access. The vulnerability stems from a failure to restrict the scope of newly created tokens to the caller’s existing permissions.

Recommendations Versions prior to 2026.3.11 should be updated to version 2026.3.11 or later.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2026-32922

Affected Products

Openclaw

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-32922 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4jpw-hj22-2xmc · Note
• https://reddit.com/r/pwnhub/comments/1s6yr6a/critical_vulnerability_in_openclaw_enables · Reddit Post
• https://twitter.com/PurpleOps_io/status/2038474222872232097 · Twitter Post
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-unvalidated-scope-in-device-token-rotate · Note
• https://twitter.com/CveFindCom/status/2038250623481545186 · Twitter Post
• https://twitter.com/CVEnew/status/2038250155678261681 · Twitter Post
• https://twitter.com/TheHackerWire/status/2038256906075242620 · Twitter Post
• https://twitter.com/botnewsnetwork/status/2038465871824458215 · Twitter Post
• https://twitter.com/OrizonCyber/status/2038247314704277757 · Twitter Post
• https://twitter.com/CVE__Tracker/status/2038452566862815276 · Twitter Post