CVE-2026-35645 - Vulnerability Analysis

Overview

OpenClaw before 2026.3.25 contains a privilege escalation caused by improper use of synthetic operator.admin runtime scope in gateway plugin subagent fallback deleteSession function, letting attackers execute privileged operations, exploit requires triggering session deletion without request-scoped client.

Severity & Score

Impact

Attackers can execute privileged operations with administrative scope, leading to privilege escalation.

Mitigation

Update to version 2026.3.25 or later.

References

• https://github.com/openclaw/openclaw/commit/b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h4jx-hjr3-fhgc
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-synthetic-operator-admin-in-deletesession

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner