CVE-2026-32922: OpenClaw privilege escalation to

CISO Take

OpenClaw's device.token.rotate endpoint fails to constrain newly minted tokens to the caller's existing scope set, allowing any user with operator.pairing access to silently upgrade themselves to operator.admin — granting remote code execution via system.run across all connected nodes and full gateway-admin control. Although not yet in CISA KEV, the CVSS 9.9 score, network-accessible attack vector requiring only low privileges and no user interaction, and the Changed scope impact that enables cluster-wide compromise make this trivially weaponizable from any initial low-privilege foothold; EPSS places this in the top 59% of vulnerabilities likely to be exploited. With 396 prior CVEs in this package and a confirmed real-world incident involving malicious OpenClaw skills exfiltrating credentials (AIID #1368), this package carries substantial security debt that warrants urgent attention. Upgrade to OpenClaw 2026.3.11 or later immediately; if patching is not feasible, restrict network access to device.token.rotate via API gateway ACLs and audit all existing tokens for scope anomalies.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS AIID

What is the risk?

Critical. The vulnerability requires only low privileges and no user interaction over the network, making it accessible to any internal user, compromised service account, or attacker who has obtained a single low-level token. The CVSS Changed scope indicator means a single exploited node can cascade to all connected gateway nodes and paired devices in the cluster. EPSS at 0.0054 is modest but the attack is mechanically straightforward — crafting a token rotation request with elevated scopes — placing real-world exploitation risk above typical network vulnerabilities of this class. The 396 prior CVEs in the same package indicate persistent security engineering debt and increase the likelihood that this package exists in unmonitored deployments.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege OpenClaw token with operator.pairing scope via credential theft from an agent config file, a leaked API key in a repository, or a compromised developer account.

AML.T0012

Privilege Escalation

Attacker calls device.token.rotate specifying operator.admin in the desired scope set; OpenClaw issues a valid admin token without validating that requested scopes are a subset of the caller's current scope.

AML.T0091.000

Discovery

Using the operator.admin token, attacker enumerates connected nodes, paired devices, and agent configurations via the gateway admin interface to map the full OpenClaw cluster.

AML.T0084

Impact

Attacker invokes system.run across connected nodes for remote code execution, exfiltrates model artifacts and embedded secrets, or injects malicious tool definitions for persistent cluster-wide access.

AML.T0053

Initial Access

Attacker obtains a low-privilege OpenClaw token with operator.pairing scope via credential theft from an agent config file, a leaked API key in a repository, or a compromised developer account.

AML.T0012

Privilege Escalation

Attacker calls device.token.rotate specifying operator.admin in the desired scope set; OpenClaw issues a valid admin token without validating that requested scopes are a subset of the caller's current scope.

AML.T0091.000

Discovery

Using the operator.admin token, attacker enumerates connected nodes, paired devices, and agent configurations via the gateway admin interface to map the full OpenClaw cluster.

AML.T0084

Impact

Attacker invokes system.run across connected nodes for remote code execution, exfiltrates model artifacts and embedded secrets, or injects malicious tool definitions for persistent cluster-wide access.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

6 steps

Upgrade to OpenClaw 2026.3.11 immediately — this is the first release that constrains minted token scopes to the caller's current scope set.
If patching is not immediately feasible, restrict API access to device.token.rotate via network ACLs or API gateway policy to block external or unauthorized callers.
Audit all active tokens in your OpenClaw deployment for scope anomalies — any token holding operator.admin scope that was not explicitly provisioned at that level should be revoked immediately.
Review audit logs for unexpected calls to device.token.rotate and system.run in the period prior to patching; treat any anomalies as active incidents.
Rotate all existing operator.admin credentials as a precaution regardless of audit findings.
Assess whether any connected nodes show evidence of lateral movement, unauthorized command execution, or modified agent tool configurations.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0091.000 - Application Access Token AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system roles and responsibilities

NIST AI RMF

GOVERN 1.4 - Organizational accountability for AI risk

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32922?

OpenClaw's device.token.rotate endpoint fails to constrain newly minted tokens to the caller's existing scope set, allowing any user with operator.pairing access to silently upgrade themselves to operator.admin — granting remote code execution via system.run across all connected nodes and full gateway-admin control. Although not yet in CISA KEV, the CVSS 9.9 score, network-accessible attack vector requiring only low privileges and no user interaction, and the Changed scope impact that enables cluster-wide compromise make this trivially weaponizable from any initial low-privilege foothold; EPSS places this in the top 59% of vulnerabilities likely to be exploited. With 396 prior CVEs in this package and a confirmed real-world incident involving malicious OpenClaw skills exfiltrating credentials (AIID #1368), this package carries substantial security debt that warrants urgent attention. Upgrade to OpenClaw 2026.3.11 or later immediately; if patching is not feasible, restrict network access to device.token.rotate via API gateway ACLs and audit all existing tokens for scope anomalies.

Is CVE-2026-32922 actively exploited?

No confirmed active exploitation of CVE-2026-32922 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32922?

1. Upgrade to OpenClaw 2026.3.11 immediately — this is the first release that constrains minted token scopes to the caller's current scope set. 2. If patching is not immediately feasible, restrict API access to device.token.rotate via network ACLs or API gateway policy to block external or unauthorized callers. 3. Audit all active tokens in your OpenClaw deployment for scope anomalies — any token holding operator.admin scope that was not explicitly provisioned at that level should be revoked immediately. 4. Review audit logs for unexpected calls to device.token.rotate and system.run in the period prior to patching; treat any anomalies as active incidents. 5. Rotate all existing operator.admin credentials as a precaution regardless of audit findings. 6. Assess whether any connected nodes show evidence of lateral movement, unauthorized command execution, or modified agent tool configurations.

What systems are affected by CVE-2026-32922?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-node agent orchestration, Agent tool execution environments, Gateway-managed AI deployments, Agentic AI workflow pipelines.

What is the CVSS score for CVE-2026-32922?

CVE-2026-32922 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.54%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-node agent orchestrationAgent tool execution environmentsGateway-managed AI deploymentsAgentic AI workflow pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0091.000 Application Access Token

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: GOVERN 1.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current scope set. Attackers can obtain operator.admin tokens for paired devices and achieve remote code execution on connected nodes via system.run or gain unauthorized gateway-admin access.

Exploitation Scenario

An attacker who has obtained a service account token with operator.pairing scope — for example, through a leaked API key in a public repository, exfiltrated credentials from an agent configuration file, or a compromised low-privilege developer account — calls device.token.rotate with a crafted payload specifying operator.admin in the desired scope set. Because OpenClaw performs no validation that the requested scopes are a subset of the caller's current scope, it returns a signed operator.admin token. The attacker enumerates connected nodes via the gateway admin interface, then invokes system.run across the cluster, achieving remote code execution to install a reverse shell, exfiltrate model artifacts and embedded secrets, or inject malicious tool definitions that persist across agent restarts. In agentic deployments where OpenClaw orchestrates downstream AI tasks, the compromised gateway can silently redirect agent workflows to attacker-controlled infrastructure.

Weaknesses (CWE)

CWE-266 Incorrect Privilege Assignment

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.