OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes...
Date: 2026-03
Affected: openclaw/openclaw
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-32302
CVE-2026-32915
CVE-2026-32916
CVE-2026-32918
CVE-2026-32919
CVE-2026-32922
CVE-2026-32923
CVE-2026-32970
CVE-2026-32971
CVE-2026-32972
CVE-2026-32973
CVE-2026-32976
CVE-2026-32977
CVE-2026-32978
CVE-2026-32979
CVE-2026-32988
CVE-2026-33573
CWE: CWE-178
CWE-266
CWE-269
CWE-284
CWE-346
CWE-367
CWE-451
CWE-59
CWE-625
CWE-636
CWE-639
CWE-668
CWE-862
CWE-863
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current scope set. Attackers can obtain operator.admin tokens for paired devices and achieve remote code execution on connected nodes via system.run or gain unauthorized gateway-admin access.


Mitigations:

Architectural layers (MAESTRO):