CVE-2026-32922CWE-266

OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate

Critical · published March 29, 2026

CVSS v4.0
9.4
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current scope set. Attackers can obtain operator.admin tokens for paired devices and achieve remote code execution on connected nodes via system.run or gain unauthorized gateway-admin access.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00693 · 52.3th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-03-29T12:44Z
EPSS history
Timeline
  • 29 MAR 12:44Z
    OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate
    cvelistv5