Openclaw cli: OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth (CVE-2026-32042)

CVE-2026-32042 affects the openclaw CLI npm package versions >=2026.2.22 and <=2026.2.24. The vulnerability allows an attacker who has valid shared gateway authentication to bypass operator pairing by attaching an unpaired device identity and requesting elevated operator scopes such as operator.admin before the pairing is approved. This results in privilege escalation. The issue is fixed in version 2026.2.25 by enforcing pairing requirements for operator device-identity sessions authenticated with shared token or password authentication, except for existing trusted proxy or control UI bypass policy paths.

Attackers with valid shared gateway authentication can escalate privileges by self-assigning higher operator scopes, including administrative rights, without completing the required device pairing process. This could lead to unauthorized administrative actions within the OpenClaw environment.

Upgrade to openclaw CLI version 2026.2.25 or later, which enforces pairing requirements for operator device-identity sessions authenticated via shared token or password authentication, thereby preventing unpaired device identities from self-assigning elevated operator scopes. No additional mitigation is required beyond applying the official fix.