EUVD-2026-21142
GHSA-m5jp-p3r5-mfqp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.28.
DescriptionCVE.org
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion without a request-scoped client to execute privileged operations with unintended administrative scope.
AnalysisAI
OpenClaw before version 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that improperly uses a synthetic operator.admin runtime scope, allowing authenticated attackers to execute privileged operations with unintended administrative access by triggering session deletion without a request-scoped client. CVSS score of 6.1 reflects the requirement for low-level user authentication (PR:L) and network accessibility; patch availability is confirmed.
Technical ContextAI
The vulnerability exists in OpenClaw's gateway plugin subagent implementation, specifically within the session deletion logic (deleteSession function). The root cause (CWE-648: Incorrect Use of Privileged APIs) stems from the improper scoping of a synthetic operator.admin runtime context. When the deleteSession function is invoked without a proper request-scoped client, the fallback mechanism applies a synthetic administrative scope that persists beyond the intended context, allowing the function to execute operations with unintended administrative privileges. This is a scope-leakage issue where privilege boundaries are not correctly enforced during function invocation. The CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* indicates the vulnerability affects OpenClaw across multiple versions prior to the patched release.
RemediationAI
Vendor-released patch: OpenClaw 2026.3.25 or later. Users should upgrade to version 2026.3.25 or newer to remediate the privilege escalation in the deleteSession function. The upstream fix is available in commit b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7 (https://github.com/openclaw/openclaw/commit/b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7), which corrects the scope handling to prevent synthetic operator.admin context leakage. No public workarounds are documented; patching is the recommended mitigation path. For urgent deployment scenarios, verify the deleteSession function is not accessible to low-privilege user roles, pending upgrade.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-648 – Incorrect Use of Privileged APIs
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today