CVE-2026-35625CWE-648

OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect

High · published April 9, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00264 · 17.4th percentile
Weakness
CWE-648 · Incorrect Use of Privileged APIs
Published
2026-04-09T21:26Z
EPSS history
Timeline
  • 09 APR 21:26Z
    OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect
    cvelistv5