Openclaw cli: OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE (CVE-2026-32922)
Description
A critical authorization vulnerability in openclaw CLI versions before 2026.3.11 allows a user with operator.pairing scope to mint tokens with broader scopes, including operator.admin, for paired devices. This flaw enables unauthorized administrative access and can lead to remote code execution on connected nodes. The issue is fixed in version 2026.3.11.
CVSS v3.1
Score 9.9critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In openclaw CLI versions <= 2026.3.8, the device.token.rotate function allowed callers with operator.pairing scope to mint new tokens with scopes broader than their own for already paired devices. If the paired device had operator.admin approval, the attacker could escalate privileges to administrative level without initially holding that scope. This flaw could lead to unauthorized gateway-admin access and, on deployments with node hosts or companion apps exposing system.run, remote code execution on nodes. The vulnerability is addressed by enforcing that newly minted device tokens cannot exceed the caller's current scopes, fixed in [email protected].
Potential Impact
This vulnerability permits privilege escalation from operator.pairing to operator.admin scope, granting unauthorized administrative access to the gateway. On deployments with connected nodes or companion apps exposing system.run, it can lead to remote code execution on those nodes. The impact includes full compromise of node execution and administrative control over the gateway.
Mitigation Recommendations
Upgrade openclaw CLI to version 2026.3.11 or later, which enforces caller-scope subsetting in device.token.rotate to prevent minting tokens with broader scopes than the caller holds.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32922
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245da12601ec6a31680a7
Added to database: 10/04/2026, 12:26:02 UTC
Last enriched: 10/04/2026, 13:20:40 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.