Openclaw EUVD-2026-17003

Attacker requires operator.pairing scope on OpenClaw before version 2026.3.11. The device.token.rotate endpoint fails to constrain newly minted tokens to caller's current scope set, allowing privilege escalation to operator.admin or gateway-admin. Authenticated access with operator.pairing permission required; no user interaction needed.

This represents a severe real-world risk despite no confirmed active exploitation. The CVSS 9.4 Critical rating accurately reflects the technical severity-authenticated attackers with minimal operator.pairing credentials can trivially escalate to operator.admin and execute arbitrary code remotely. The low attack complexity (AC:L) and network attack vector (AV:N) indicate this is readily exploitable once an attacker obtains any valid low-privilege token, potentially through compromised IoT devices or insider access. The publicly accessible GitHub security advisory (GHSA-4jpw-hj22-2xmc) and VulnCheck disclosure provide sufficient technical detail for exploit development. While EPSS probability data is unavailable and KEV status shows no confirmed exploitation, the combination of RCE capability, authentication bypass characteristics, and public disclosure elevates urgency significantly. Organizations using OpenClaw for device fleet management face immediate risk of lateral movement across connected nodes and complete gateway infrastructure compromise. This vulnerability is highly automatable once initial low-privilege access is achieved, warranting immediate patching priority per SSVC framework given the high technical impact and network exposure.

An attacker compromises a low-privilege IoT device registered with OpenClaw, obtaining an operator.pairing scoped authentication token through credential theft or device firmware extraction. The attacker calls the vulnerable device.token.rotate API, requesting a new token with operator.admin scope. Due to missing scope validation, the API mints the elevated token despite the caller holding only operator.pairing privileges. With operator.admin access, the attacker invokes the system.run API to execute arbitrary commands on all connected gateway nodes, deploying persistent backdoors and exfiltrating sensitive operational data from the entire device fleet. No public exploit identified at time of analysis, though the GitHub advisory provides implementation details sufficient for rapid weaponization.