Vulnerability · Published Apr 9, 2026 · Assigned by VulnCheck
CVE-2026-35625OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect
High 7.8
In plain English
A high-severity security flaw in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 90.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | openclaw | no fix listed | GHSA-fqw4-mph7-2vr8 |
Affected products (as reported)
Weakness: CWE-648 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-fqw4-mph7-2vr8) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect third-party-advisory