CVE-2026-32042 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.25 contains a privilege escalation vulnerability caused by unpaired device identities bypassing operator pairing in authentication, letting attackers with valid shared gateway authentication self-assign elevated operator scopes, exploit requires valid shared gateway authentication.

Severity & Score

Impact

Attackers with valid shared gateway authentication can escalate privileges to operator.admin, compromising system control.

Mitigation

Update to version 2026.2.25 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-553v-f69r-656j
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unpaired-device-identity-in-shared-gateway-authentication
• https://github.com/openclaw/openclaw/commit/8d1481cb4a9d31bd617e52dc8c392c35689d9dea

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner