Openclaw CVE-2026-32042

Attacker must have valid shared gateway authentication credentials for OpenClaw 2026.2.22 prior to 2026.2.25. Attacker presents self-signed unpaired device identity to bypass operator pairing requirements and self-assign elevated operator.admin scopes. No victim interaction required.

This represents a significant real-world risk despite requiring low-level authentication (PR:L). The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with network-based attack vector (AV:N), low complexity (AC:L), and no user interaction required (UI:N). The vulnerability is particularly dangerous because it allows lateral privilege escalation from a low-privileged authenticated user to full administrator, enabling complete system compromise. The attack is straightforward to execute once an attacker has obtained valid shared gateway credentials, which could be acquired through credential theft, insider threats, or compromised low-privilege accounts. The availability of a detailed vendor advisory and public commit patch (https://github.com/openclaw/openclaw/commit/8d1481cb4a9d31bd617e52dc8c392c35689d9dea) means security researchers and potential attackers can reverse-engineer the vulnerability. Organizations using OpenClaw in production environments, especially those with shared gateway authentication enabled, should treat this as a high-priority remediation target.

An attacker obtains valid shared gateway authentication credentials through phishing, credential stuffing, or by compromising a low-privilege service account. The attacker crafts a request with a self-signed unpaired device identity to the OpenClaw gateway, claiming elevated operator.admin scope. Because the system fails to verify pairing approval status before granting scopes, the attacker receives administrator privileges and can now access sensitive data, modify system configurations, create backdoor accounts, or disrupt operations across the OpenClaw deployment.