CVE-2026-35645CWE-648

OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession

Medium · published April 9, 2026

CVSS v4.0
6.1
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion without a request-scoped client to execute privileged operations with unintended administrative scope.

The record
Technical detail
CVSS v4.0
6.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-648 · Incorrect Use of Privileged APIs
Published
2026-04-09T21:27Z
EPSS history
Timeline
  • 09 APR 21:27Z
    OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession
    cvelistv5