OpenClaw privilege escalation to admin (CVE-2026-32922)

Overview

A critical privilege escalation vulnerability has been discovered in OpenClaw, a device management platform. Tracked as CVE-2026-32922, this flaw resides in the device.token.rotate function. It allows an authenticated user with limited permissions to create new authentication tokens with significantly broader, unauthorized access rights.

Vulnerability Explained

In simple terms, the system fails to properly check permissions when generating new tokens. An attacker with the basic operator.pairing scope-a standard low-level permission for linking devices-can exploit this flaw. The vulnerability does not restrict newly minted tokens to the caller’s existing permissions. Consequently, an attacker can craft a token with the powerful operator.admin scope, effectively granting them full administrative control over paired devices and the broader system.

Potential Impact

The impact of this vulnerability is severe. Successful exploitation enables an attacker to:

• Gain full administrative control (operator.admin) over any device they have paired with.
• Execute arbitrary commands on connected nodes via the system.run function, leading to remote code execution (RCE).
• Obtain unauthorized gateway-admin access to central management gateways.
• Potentially move laterally across a network, compromise sensitive data, and disrupt critical operations. This level of access mirrors a complete system takeover.

For context on how such vulnerabilities can lead to real-world incidents, recent data breach reports are available at breach reports.

Remediation and Mitigation

Immediate action is required to protect affected systems.

Primary Remediation: The only complete fix is to upgrade OpenClaw to version 2026.3.11 or later. This update corrects the scope validation logic in the token rotation process. All organizations using OpenClaw should prioritize this update.

Temporary Mitigation (If Immediate Patching is Not Possible):

1. Audit and Monitor: Immediately review audit logs for any unusual token generation or privilege escalation activities, particularly from accounts with operator.pairing scope.
2. Restrict Pairing: Temporarily limit the assignment of the operator.pairing scope to only absolutely essential, trusted personnel and devices.
3. Network Segmentation: Ensure OpenClaw management interfaces are not exposed to the public internet and are placed within a secured network segment.

Stay informed about critical vulnerabilities and patches by following the latest security news. Do not delay in applying the official patch, as this vulnerability is highly exploitable and poses a critical risk to system integrity and security.