Loading vulnerability…
Privilege Escalation in OpenClaw Gateway-Authenticated Plugin HTTP Routes
CVE-2026-35669 is a privilege escalation vulnerability affecting OpenClaw versions before 2026.3.25. The flaw exists in gateway-authenticated plugin HTTP routes, where the application incorrectly mints the operator.admin runtime scope regardless of the scopes actually granted to the caller. This results in a scope boundary bypass in which a lower-privileged authenticated caller can obtain administrative runtime authorization that should not have been issued. Successful exploitation allows the attacker to invoke functionality intended only for operator-level administrators.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker with low privileges to escalate to administrative capabilities within OpenClaw. Because the vulnerable routes mint operator.admin runtime scope irrespective of the caller’s authorized scopes, an attacker can perform unauthorized administrative actions. Based on the provided CVSS assessment, the impact is high across confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to gateway-authenticated plugin HTTP routes to only trusted principals, minimize assigned privileges for accounts that can reach those routes, and monitor for administrative actions originating from non-administrative identities. As an additional temporary control, disable or limit exposure of affected plugin HTTP routes where operationally feasible until the upgrade can be applied.
Patch, then assume compromise.
Upgrade OpenClaw to version 2026.3.25 or later, which contains the fix for the incorrect runtime scope minting behavior in gateway-authenticated plugin HTTP routes. Review the associated OpenClaw fix commit and vendor advisory to validate that all affected deployments have been updated.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.