Which versions of Openclaw are affected by CVE-2026-35669?

CVE-2026-35669 is a privilege escalation vulnerability in OpenClaw's gateway-authenticated plugin that allows authenticated users with low-level access to escalate to operator.admin privileges,…. A patch is available.

How to fix or mitigate CVE-2026-35669?

Within 24 hours: Identify all systems running OpenClaw versions prior to 2026.3.25 and assess exposure to low-privileged authenticated users. Within 7 days: Apply vendor patch to upgrade OpenClaw to version 2026.3.25 or later across all affected instances. Within 30 days: Conduct access review of operator.admin accounts to identify any unauthorized changes, and implement monitoring for scope restriction bypass attempts in gateway logs.

Openclaw CVE-2026-35669

Q: What is the CVSS score of CVE-2026-35669?

CVE-2026-35669 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21484 HIGH

Incorrect Use of Privileged APIs (CWE-648)

2026-04-10 VulnCheck

GHSA-qm2m-28pf-hgjw

Privilege Escalation Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 16:30 euvd

EUVD-2026-21484

Analysis Generated

Apr 10, 2026 - 16:30 vuln.today

Patch released

Apr 10, 2026 - 16:30 nvd

Patch available

CVE Published

Apr 10, 2026 - 16:03 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.24.

DescriptionCVE.org

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gain elevated privileges and perform unauthorized administrative actions.

AnalysisAI

Privilege escalation in OpenClaw gateway-authenticated plugin HTTP routes allows authenticated attackers to bypass scope restrictions and gain operator.admin privileges. The vulnerability affects OpenClaw versions prior to 2026.3.25, enabling low-privileged authenticated users to perform unauthorized administrative actions through improperly minted runtime scopes. Exploitation requires network access and low-level authentication but no user interaction. No public exploit identified at time of analysis.

Technical ContextAI

CWE-648 scope boundary bypass occurs when gateway-authenticated plugin HTTP routes incorrectly mint operator.admin runtime scope without validating caller-granted scopes. The authentication mechanism (CVSS PR:L) fails to enforce proper privilege boundaries during scope elevation, allowing horizontal privilege escalation from legitimate low-privilege credentials to full administrative context.

RemediationAI

Vendor-released patch: upgrade to OpenClaw 2026.3.25 or later, which corrects scope minting logic in gateway-authenticated plugin HTTP routes. The fix is implemented in commit ec2dbcff9afd8a52e00de054b506c91726d9fbbe. Organizations unable to immediately upgrade should disable gateway-authenticated plugin HTTP routes or restrict network access to trusted authenticated users only until patching is complete. Review existing authentication logs for evidence of unauthorized scope elevation to operator.admin privileges. Consult vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-qm2m-28pf-hgjw and VulnCheck analysis at https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-gateway-plugin-http-authentication-scope for additional technical details and detection guidance.