CVE-2026-32922

OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate

State: Published
Severity: 9.4 Critical
Published: Mar 29, 2026
Updated: Jun 23, 2026
Reserved: Mar 16, 2026

Description

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current scope set. Attackers can obtain operator.admin tokens for paired devices and achieve remote code execution on connected nodes via system.run or gain unauthorized gateway-admin access.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	VulnCheck
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.3.11Affected 2026.3.11Not affected

References

GitHub Security Advisory (GHSA-4jpw-hj22-2xmc)vendor-advisory
VulnCheck Advisory: OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotatethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.