CVE-2026-32042: OpenClaw privilege escalation

CISO Take

OpenClaw versions prior to 2026.2.25 allow any actor with valid shared gateway credentials to present a self-signed, unpaired device identity and self-assign operator.admin scope before pairing approval is granted—completely bypassing the authorization gate designed to gate privileged access. With CVSS 8.8, network-accessible attack vector, and only low-privilege credentials required, every AI agent deployment using OpenClaw's shared gateway model is exposed, and the package's track record of 396 CVEs signals systemic authorization weaknesses rather than an isolated flaw. EPSS places this in the top 65th percentile for exploitation likelihood, and active threat actor familiarity with OpenClaw's ecosystem—documented in AIID #1368 where 17% of third-party skills were found to be malicious—means attackers are already positioned to weaponize an admin-scope escalation. Patch to 2026.2.25 immediately via commit 8d1481cb; if patching is not possible, restrict shared gateway authentication at the network level and audit all existing operator scope assignments for unexpected operator.admin grants.

Sources: NVD EPSS GitHub Advisory ATLAS AIID

What is the risk?

HIGH. The incorrect authorization flaw (CWE-863) requires only low-privilege shared gateway credentials and zero user interaction, making it accessible to insiders, compromised accounts, or any attacker with network reach to the gateway. Gaining operator.admin scope delivers full administrative control over the AI agent's behavior, tool invocations, and all data the agent is authorized to access. The 396 historical CVEs in this package and documented active abuse of its third-party ecosystem (AIID #1368) indicate a pattern of systemic security weaknesses, raising the probability that this specific escalation path will be discovered and exploited by threat actors already familiar with the attack surface.

How does the attack unfold?

Initial Access

Attacker obtains valid low-privilege shared gateway credentials via credential reuse, phishing, or insider access, sufficient to authenticate to the OpenClaw gateway API.

AML.T0012

Authorization Bypass

Attacker presents a self-signed, unpaired device identity to the gateway API and requests operator.admin scope; the flawed CWE-863 authorization check grants it without verifying pairing approval status.

AML.T0049

Privilege Escalation

Attacker self-assigns operator.admin scope before any human operator can review or deny the pairing request, bypassing the approval gate entirely.

AML.T0107

Impact

With operator.admin access, attacker modifies agent configuration, invokes privileged tools to exfiltrate data or execute commands, and potentially pivots to connected systems the agent is authorized to access.

AML.T0053

Initial Access

Attacker obtains valid low-privilege shared gateway credentials via credential reuse, phishing, or insider access, sufficient to authenticate to the OpenClaw gateway API.

AML.T0012

Authorization Bypass

Attacker presents a self-signed, unpaired device identity to the gateway API and requests operator.admin scope; the flawed CWE-863 authorization check grants it without verifying pairing approval status.

AML.T0049

Privilege Escalation

Attacker self-assigns operator.admin scope before any human operator can review or deny the pairing request, bypassing the approval gate entirely.

AML.T0107

Impact

With operator.admin access, attacker modifies agent configuration, invokes privileged tools to exfiltrate data or execute commands, and potentially pivots to connected systems the agent is authorized to access.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch immediately to OpenClaw 2026.2.25 (patch commit 8d1481cb4a9d31bd617e52dc8c392c35689d9dea).
If patching is not immediately possible: disable shared gateway authentication or enforce network-level ACLs to restrict which hosts can reach the gateway endpoint.
Audit all existing operator scope assignments for unexpected operator.admin grants and revoke any suspicious elevations immediately.
Review gateway authentication logs for unpaired device identity presentations prior to the patch date to identify potential prior exploitation.
Implement alerting on any operator.admin scope assignment events until the patch is confirmed deployed.
For multi-tenant deployments, isolate gateways per tenant as a defense-in-depth measure regardless of patch status.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent API AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.1.2 - AI system roles and responsibilities

NIST AI RMF

GOVERN-6.2 - Organizational risk policies for AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32042?

OpenClaw versions prior to 2026.2.25 allow any actor with valid shared gateway credentials to present a self-signed, unpaired device identity and self-assign operator.admin scope before pairing approval is granted—completely bypassing the authorization gate designed to gate privileged access. With CVSS 8.8, network-accessible attack vector, and only low-privilege credentials required, every AI agent deployment using OpenClaw's shared gateway model is exposed, and the package's track record of 396 CVEs signals systemic authorization weaknesses rather than an isolated flaw. EPSS places this in the top 65th percentile for exploitation likelihood, and active threat actor familiarity with OpenClaw's ecosystem—documented in AIID #1368 where 17% of third-party skills were found to be malicious—means attackers are already positioned to weaponize an admin-scope escalation. Patch to 2026.2.25 immediately via commit 8d1481cb; if patching is not possible, restrict shared gateway authentication at the network level and audit all existing operator scope assignments for unexpected operator.admin grants.

Is CVE-2026-32042 actively exploited?

No confirmed active exploitation of CVE-2026-32042 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32042?

1. Patch immediately to OpenClaw 2026.2.25 (patch commit 8d1481cb4a9d31bd617e52dc8c392c35689d9dea). 2. If patching is not immediately possible: disable shared gateway authentication or enforce network-level ACLs to restrict which hosts can reach the gateway endpoint. 3. Audit all existing operator scope assignments for unexpected operator.admin grants and revoke any suspicious elevations immediately. 4. Review gateway authentication logs for unpaired device identity presentations prior to the patch date to identify potential prior exploitation. 5. Implement alerting on any operator.admin scope assignment events until the patch is confirmed deployed. 6. For multi-tenant deployments, isolate gateways per tenant as a defense-in-depth measure regardless of patch status.

What systems are affected by CVE-2026-32042?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI agent deployments, shared gateway authentication systems, AI agent orchestration platforms.

What is the CVSS score for CVE-2026-32042?

CVE-2026-32042 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI agent deploymentsshared gateway authentication systemsAI agent orchestration platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.1.2

NIST AI RMF: GOVERN-6.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-assign elevated operator scopes including operator.admin. Attackers with valid shared gateway authentication can present a self-signed unpaired device identity to request and obtain higher operator scopes before pairing approval is granted.

Exploitation Scenario

An attacker with a low-privilege shared gateway credential—obtained via credential reuse, phishing, or insider access—crafts a request presenting a self-signed, unpaired device identity to OpenClaw's network-accessible gateway API. Before any pairing approval workflow is triggered, the flawed authorization layer processes the scope request and grants operator.admin. The attacker now has full administrative control over the AI agent: they modify its configuration (AML.T0081) to alter behavior or implant backdoor instructions, invoke any tool the agent is authorized to use including internal data stores, code execution environments, or external APIs (AML.T0053), and potentially pivot to connected systems. In environments where OpenClaw agents have access to sensitive internal resources—a pattern made plausible by AIID #1368's documented abuse of the skills ecosystem—this escalation serves as a high-privilege beachhead for broader compromise with no visible user interaction required.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.