Loading vulnerability…
Privilege Escalation in OpenClaw Unpaired Device Identity Handling
CVE-2026-32042 is a privilege escalation vulnerability in OpenClaw affecting versions 2026.2.22 prior to 2026.2.25. The flaw allows an unpaired device identity to bypass the intended operator pairing approval workflow and request elevated operator scopes, including operator.admin, before pairing approval is granted. According to the provided information, an attacker with valid shared gateway authentication can present a self-signed unpaired device identity and obtain higher operator scopes that should only be available after successful pairing and authorization checks. The issue is consistent with an incorrect authorization weakness in the handling of device identity and operator scope assignment.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged but authenticated attacker to escalate privileges within OpenClaw by obtaining elevated operator scopes, including operator.admin. This can result in unauthorized administrative access and full compromise of the affected application's confidentiality, integrity, and availability, as reflected by the provided CVSS vectors. An attacker gaining operator.admin-equivalent access may be able to perform privileged administrative actions, access sensitive data, modify configuration or authorization state, and disrupt service operation.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict or disable exposure of shared gateway authentication paths to untrusted users and devices, and tightly control issuance and acceptance of device identities. Enforce operational controls so that unpaired devices cannot request or receive elevated scopes, and monitor for attempts to use self-signed unpaired device identities or unexpected assignment of privileged scopes such as operator.admin. Review authentication and authorization logs for scope grants occurring before pairing approval, and limit access to shared gateway credentials to the minimum necessary set of trusted operators and systems.
Patch, then assume compromise.
Upgrade OpenClaw to version 2026.2.25 or later, as the vulnerability affects versions 2026.2.22 prior to 2026.2.25. The provided references indicate that a fix is available in the OpenClaw codebase, including GitHub commit 8d1481cb4a9d31bd617e52dc8c392c35689d9dea and GitHub security advisory GHSA-553v-f69r-656j. Apply the vendor-provided fix and verify that unpaired device identities cannot obtain elevated operator scopes before pairing approval is completed.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.