identity-authentication-vulnerabilityprivilege-escalation-methodwidely-deployed-product-advisoryinternet-facing-service-vulnerability

OpenClaw Flaws Allowed Authentication Bypass and Admin Privilege Escalation

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Mar 21, 2026

OpenClaw disclosed two high-severity vulnerabilities affecting versions before 2026.2.21 and 2026.3.25, exposing gateway routes to unauthorized access and privilege escalation. CVE-2026-32045 is an authentication bypass in HTTP gateway routes caused by incorrect application of tokenless Tailscale header authentication, allowing attackers on trusted networks to reach protected routes without valid tokens or passwords. The issue is tracked as CWE-290 and carries a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a confidentiality-focused impact.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Feb 21, 2026 – Apr 10, 2026

Apr 10, 20267mo ago
CVE-2026-35663 publicly disclosed
A high-severity OpenClaw vulnerability, CVE-2026-35663, was publicly disclosed affecting versions before 2026.3.25. The privilege escalation flaw in the backend reconnect process allowed non-admin operators to self-request broader scopes, bypass pairing requirements, and reconnect as operator.admin.
CVE-2026-35663 - OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim
Apr 10, 20267mo ago
CVE-2026-35669 publicly disclosed
CVE-2026-35669 was publicly disclosed on April 10, 2026 as a high-severity OpenClaw privilege escalation vulnerability. It was classified as CWE-648 and described as allowing a low-privileged attacker to obtain operator.admin runtime scope and perform unauthorized actions.
Apr 10, 20267mo ago
VulnCheck receives disclosure for CVE-2026-35669
The privilege escalation vulnerability later assigned CVE-2026-35669 was received by disclosure@vulncheck.com on April 10, 2026. The flaw involved improper authentication scope handling in OpenClaw plugin HTTP routes.
Mar 25, 20268mo ago
OpenClaw fixes privilege escalation in version 2026.3.25
OpenClaw addressed CVE-2026-35669 in version 2026.3.25, fixing a privilege escalation flaw in gateway-authenticated plugin HTTP routes that incorrectly minted the operator.admin runtime scope. The bug affected versions before 2026.3.25 and could let low-privileged users gain elevated administrative capabilities.
Mar 21, 20268mo ago
CVE-2026-32045 publicly disclosed
A high-severity vulnerability, CVE-2026-32045, was disclosed for OpenClaw on March 21, 2026. The issue was classified as CWE-290 and described as enabling unauthorized access to HTTP gateway routes without valid authentication credentials.
Feb 21, 20269mo ago
OpenClaw fixes authentication bypass in version 2026.2.21
OpenClaw addressed CVE-2026-32045 in version 2026.2.21, fixing an authentication bypass in HTTP gateway routes caused by incorrect application of tokenless Tailscale header authentication. The flaw affected versions prior to 2026.2.21 and could allow attackers on trusted networks to access routes without valid tokens or passwords.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

Authentication Bypass in OpenClaw HTTP Gateway Routes via Tokenless Tailscale Header Authentication (CVE-2026-32045)Privilege Escalation in OpenClaw Gateway-Authenticated Plugin HTTP Routes (CVE-2026-35669)Privilege Escalation in OpenClaw Backend Reconnect (CVE-2026-35663)

Affected products

1 linked

Openclaw

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 10, 2026

CVE-2026-35663 - OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-ClaimOpen source ↗

Cvefeed High SeverityAdvisories · Apr 10, 2026

CVE-2026-35669 - OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication ScopeOpen source ↗

Cvefeed High SeverityAdvisories · Mar 21, 2026

CVE-2026-32045 - OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale AuthOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

identity-authentication-vulnerabilityprivilege-escalation-methodwidely-deployed-product-advisoryinternet-facing-service-vulnerability

OpenClaw Flaws Allowed Authentication Bypass and Admin Privilege Escalation

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Mar 21, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Feb 21, 2026 – Apr 10, 2026

Apr 10, 20267mo ago
CVE-2026-35663 publicly disclosed
A high-severity OpenClaw vulnerability, CVE-2026-35663, was publicly disclosed affecting versions before 2026.3.25. The privilege escalation flaw in the backend reconnect process allowed non-admin operators to self-request broader scopes, bypass pairing requirements, and reconnect as operator.admin.
CVE-2026-35663 - OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim
Apr 10, 20267mo ago
CVE-2026-35669 publicly disclosed
CVE-2026-35669 was publicly disclosed on April 10, 2026 as a high-severity OpenClaw privilege escalation vulnerability. It was classified as CWE-648 and described as allowing a low-privileged attacker to obtain operator.admin runtime scope and perform unauthorized actions.
Apr 10, 20267mo ago
VulnCheck receives disclosure for CVE-2026-35669
The privilege escalation vulnerability later assigned CVE-2026-35669 was received by disclosure@vulncheck.com on April 10, 2026. The flaw involved improper authentication scope handling in OpenClaw plugin HTTP routes.
Mar 25, 20268mo ago
OpenClaw fixes privilege escalation in version 2026.3.25
OpenClaw addressed CVE-2026-35669 in version 2026.3.25, fixing a privilege escalation flaw in gateway-authenticated plugin HTTP routes that incorrectly minted the operator.admin runtime scope. The bug affected versions before 2026.3.25 and could let low-privileged users gain elevated administrative capabilities.
Mar 21, 20268mo ago
CVE-2026-32045 publicly disclosed
A high-severity vulnerability, CVE-2026-32045, was disclosed for OpenClaw on March 21, 2026. The issue was classified as CWE-290 and described as enabling unauthorized access to HTTP gateway routes without valid authentication credentials.
Feb 21, 20269mo ago
OpenClaw fixes authentication bypass in version 2026.2.21
OpenClaw addressed CVE-2026-32045 in version 2026.2.21, fixing an authentication bypass in HTTP gateway routes caused by incorrect application of tokenless Tailscale header authentication. The flaw affected versions prior to 2026.2.21 and could allow attackers on trusted networks to access routes without valid tokens or passwords.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

Affected products

1 linked

Openclaw

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 10, 2026

CVE-2026-35663 - OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-ClaimOpen source ↗

Cvefeed High SeverityAdvisories · Apr 10, 2026

CVE-2026-35669 - OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication ScopeOpen source ↗

Cvefeed High SeverityAdvisories · Mar 21, 2026

CVE-2026-32045 - OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale AuthOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

OpenClaw Flaws Allowed Authentication Bypass and Admin Privilege Escalation

How this story unfolded

CVE-2026-35663 publicly disclosed

CVE-2026-35669 publicly disclosed

VulnCheck receives disclosure for CVE-2026-35669

OpenClaw fixes privilege escalation in version 2026.3.25

CVE-2026-32045 publicly disclosed

OpenClaw fixes authentication bypass in version 2026.2.21

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

OpenClaw Flaws Let Authenticated Users Escalate Privileges and Bypass Authorization

Multiple OpenClaw flaws enable authorization bypass and privilege escalation

OpenClaw SSRF Flaws Expose Internal Services Through Citation Redirects and Image Fetches

OpenClaw Flaws Allowed Authentication Bypass and Admin Privilege Escalation

How this story unfolded

CVE-2026-35663 publicly disclosed

CVE-2026-35669 publicly disclosed

VulnCheck receives disclosure for CVE-2026-35669

OpenClaw fixes privilege escalation in version 2026.3.25

CVE-2026-32045 publicly disclosed

OpenClaw fixes authentication bypass in version 2026.2.21

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

OpenClaw Flaws Let Authenticated Users Escalate Privileges and Bypass Authorization

Multiple OpenClaw flaws enable authorization bypass and privilege escalation

OpenClaw SSRF Flaws Expose Internal Services Through Citation Redirects and Image Fetches