OpenClaw Authorization and Access Control

Privilege escalation in OpenClaw device token rotation (versions before 2026.3.11) enables authenticated attackers with operator.pairing scope to mint tokens with arbitrary elevated scopes, including operator.admin privileges. This scope validation bypass permits remote code execution on connected nodes via system.run API and unauthorized gateway-admin access. CVSS 9.4 (Critical) with network attack vector and low complexity. EPSS and KEV data not provided; no public exploit identified at time of analysis, though technical details disclosed via GitHub security advisory increase exploitation risk.

Approval bypass in OpenClaw before 2026.3.11 allows low-privileged remote attackers to execute arbitrary code by exploiting race conditions in system.run approvals. Attackers obtain legitimate approval for benign scripts, then overwrite referenced files before execution via vulnerable tsx/jiti runners. With CVSS 9.4 (critical severity, network-accessible, low complexity) and EPSS data not yet available for this 2026 CVE, organizations using OpenClaw's script execution features face immediate risk despite requiring user interaction and low-level authentication. No public exploit identified at time of analysis, though the approval bypass mechanism is documented in vendor advisory GHSA-qc36-x95h-7j53.

Sandbox escape in OpenClaw versions before 2026.3.11 enables low-privilege leaf subagents to bypass isolation boundaries and manipulate sibling processes with elevated tool policies. Local authenticated attackers can terminate competing worker threads, redirect execution flows, and execute operations outside their intended security context by exploiting insufficient authorization on subagent control APIs. EPSS data not available for this recent CVE; no public exploit identified at time of analysis, though the technical advisory provides detailed vulnerability mechanics.

Session sandbox escape in OpenClaw versions prior to 2026.3.11 allows local authenticated attackers with low-privilege sandboxed subagent access to read and modify session data across isolation boundaries by manipulating sessionKey parameters in the session_status tool. Exploitation enables unauthorized access to parent or sibling session state including persisted model overrides, bypassing critical security isolation controls. No public exploit identified at time of analysis, though the authentication bypass mechanism is clearly documented in vendor security advisory.

Privilege escalation in OpenClaw versions before 2026.3.12 allows authenticated users with command authorization to access owner-restricted configuration and debug endpoints due to missing permission checks. Attackers can read and modify privileged settings intended only for owners, effectively bypassing role-based access controls. CVSS 8.7 (High) with EPSS data unavailable; no public exploit identified at time of analysis, though the vulnerability class (CWE-863: incorrect authorization) is commonly targeted once disclosed.

Authorization bypass in OpenClaw gateway agent RPC enables authenticated operators with operator.write permission to escape workspace boundaries and execute arbitrary operations outside designated directories. Attackers supply malicious spawnedBy and workspaceDir parameters to perform file and exec operations from any process-accessible location. CVSS 8.7 reflects high confidentiality, integrity, and availability impact with network attack vector and low complexity. No public exploit identified at time of analysis, though EPSS data unavailable. VulnCheck identified this as an information disclosure vector affecting OpenClaw versions prior to 2026.3.11.

Credential exposure in OpenClaw gateway pairing mechanism allows remote attackers to extract and reuse long-lived shared gateway credentials embedded in pairing setup codes. Attackers who obtain QR codes or pairing tokens from chat logs, screenshots, or system logs can recover persistent gateway credentials intended for one-time use, enabling unauthorized gateway access without authentication. EPSS data not available; no public exploit identified at time of analysis. Affects OpenClaw versions prior to 2026.3.12.

Privilege escalation in OpenClaw versions prior to 2026.3.11 allows authenticated users with operator.write permissions to execute administrative browser profile management functions, bypassing role-based access controls. Attackers can persist malicious remote Chrome DevTools Protocol (CDP) endpoints to disk, enabling potential remote code execution or session hijacking without operator.admin privileges. EPSS data not available; no public exploit identified at time of analysis. CVSS 7.1 (High) reflects network-accessible attack requiring only low-privileged authentication.

OpenClaw before version 2026.3.11 allows authenticated operators with write-scoped permissions to bypass authorization controls and execute admin-only session reset functionality. Attackers holding operator.write privileges can issue agent requests containing /new or /reset slash commands to reset conversation state without requiring operator.admin credentials, resulting in unauthorized modification of session data. This vulnerability has a CVSS score of 6.9 and affects the core authorization logic that protects sensitive administrative operations.

OpenClaw before version 2026.3.12 permits authorization bypass in Feishu reaction event handling when chat_type parameters are omitted, causing group chat events to be misclassified as peer-to-peer conversations and allowing attackers to circumvent groupAllowFrom and requireMention security controls. Unauthenticated remote attackers can exploit this with low complexity to achieve partial confidentiality and integrity impacts. No public exploit code has been identified, but the vulnerability is straightforward to trigger once the root cause is understood.

OpenClaw before version 2026.3.11 allows authenticated non-allowlisted Discord guild members to bypass authorization checks on reaction ingestion events, enabling them to inject arbitrary reaction text into downstream session context that is trusted as legitimate system events. This authentication-required authorization bypass affects all OpenClaw deployments integrating Discord guild reaction handling and has a CVSS score of 5.3 with confirmed patch availability.