CVE-2026-35625: OpenClaw privilege escalation to RCE

CISO Take

OpenClaw versions before 2026.3.25 contain a local privilege escalation flaw where the shared-auth reconnect mechanism silently auto-approves scope-upgrade requests, widening paired device permissions from operator.read to operator.admin and enabling remote code execution on the affected node. While the local attack vector limits exposure to scenarios where an adversary already has a foothold, EPSS places this vulnerability in the top 91st percentile for exploitation likelihood, and the combination of low attack complexity and no required user interaction makes it trivially exploitable once local access exists. The 396 existing CVEs catalogued in this package signal systemic security debt that warrants broader scrutiny of any OpenClaw-based AI agent deployment. Teams should patch immediately to 2026.3.25 or later, audit all paired device permission scopes for unauthorized admin grants, and implement monitoring for anomalous reconnect events followed by scope changes.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High risk for organizations running OpenClaw-based AI agent deployments. The CVSS 7.8 score reflects low attack complexity and no user interaction requirement once local access is established. EPSS 91st percentile indicates elevated real-world exploitation probability relative to the broader CVE landscape, despite the absence of a public exploit or CISA KEV listing. Impact is compounded by the RCE capability and the privileged nature of AI agent nodes, which typically have broad access to models, configurations, downstream APIs, and execution environments. Blast radius is partially mitigated by the local-only attack vector and only 4 downstream dependents, but the 396 existing CVEs in the same package represent systemic security debt and suggest this package warrants continuous monitoring.

How does the attack unfold?

Initial Access

Attacker gains low-privilege local access to a host running OpenClaw via a compromised service account, container escape, or insider access.

AML.T0012

Trigger Reconnect

Attacker triggers a local shared-auth reconnection event in OpenClaw by disrupting the local network interface or injecting a reconnect signal into the IPC channel.

AML.T0081

Silent Privilege Escalation

OpenClaw's shared-auth mechanism silently auto-approves the pending scope-upgrade request, widening paired device permissions from operator.read to operator.admin without user confirmation.

AML.T0053

Remote Code Execution

Attacker leverages newly acquired admin permissions to execute arbitrary code on the node, enabling lateral movement to connected AI infrastructure, credential exfiltration, and persistent agent compromise.

AML.T0112.000

Initial Access

Attacker gains low-privilege local access to a host running OpenClaw via a compromised service account, container escape, or insider access.

AML.T0012

Trigger Reconnect

Attacker triggers a local shared-auth reconnection event in OpenClaw by disrupting the local network interface or injecting a reconnect signal into the IPC channel.

AML.T0081

Silent Privilege Escalation

OpenClaw's shared-auth mechanism silently auto-approves the pending scope-upgrade request, widening paired device permissions from operator.read to operator.admin without user confirmation.

AML.T0053

Remote Code Execution

Attacker leverages newly acquired admin permissions to execute arbitrary code on the node, enabling lateral movement to connected AI infrastructure, credential exfiltration, and persistent agent compromise.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch immediately: upgrade OpenClaw to version 2026.3.25 or later (patch commit 81ebc7e0344fd19c85778e883bad45e2da972229).
If immediate patching is not feasible, disable or strictly restrict the shared-auth reconnect feature at the configuration level and enforce manual re-authorization for all scope upgrades.
Audit all paired device permission scopes and revoke any operator.admin grants that were not explicitly and recently authorized.
Apply least-privilege principles to AI agent node service accounts — operator.read should be the default, with admin upgrades requiring explicit human approval and audit logging.
Monitor OpenClaw logs for anomalous reconnect events, particularly those followed by permission scope changes.
Reference the vendor advisory (GHSA-fqw4-mph7-2vr8) and VulnCheck advisory for additional indicators and remediation guidance.

How is it classified?

Auth Bypass Code Execution Agent AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

6.1.2 - AI risk treatment

NIST AI RMF

MANAGE 2.4 - Residual risks and incidents managed

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35625?

OpenClaw versions before 2026.3.25 contain a local privilege escalation flaw where the shared-auth reconnect mechanism silently auto-approves scope-upgrade requests, widening paired device permissions from operator.read to operator.admin and enabling remote code execution on the affected node. While the local attack vector limits exposure to scenarios where an adversary already has a foothold, EPSS places this vulnerability in the top 91st percentile for exploitation likelihood, and the combination of low attack complexity and no required user interaction makes it trivially exploitable once local access exists. The 396 existing CVEs catalogued in this package signal systemic security debt that warrants broader scrutiny of any OpenClaw-based AI agent deployment. Teams should patch immediately to 2026.3.25 or later, audit all paired device permission scopes for unauthorized admin grants, and implement monitoring for anomalous reconnect events followed by scope changes.

Is CVE-2026-35625 actively exploited?

No confirmed active exploitation of CVE-2026-35625 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35625?

1. Patch immediately: upgrade OpenClaw to version 2026.3.25 or later (patch commit 81ebc7e0344fd19c85778e883bad45e2da972229). 2. If immediate patching is not feasible, disable or strictly restrict the shared-auth reconnect feature at the configuration level and enforce manual re-authorization for all scope upgrades. 3. Audit all paired device permission scopes and revoke any operator.admin grants that were not explicitly and recently authorized. 4. Apply least-privilege principles to AI agent node service accounts — operator.read should be the default, with admin upgrades requiring explicit human approval and audit logging. 5. Monitor OpenClaw logs for anomalous reconnect events, particularly those followed by permission scope changes. 6. Reference the vendor advisory (GHSA-fqw4-mph7-2vr8) and VulnCheck advisory for additional indicators and remediation guidance.

What systems are affected by CVE-2026-35625?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent deployments, distributed AI node clusters, AI-integrated CI/CD pipelines.

What is the CVSS score for CVE-2026-35625?

CVE-2026-35625 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent deploymentsdistributed AI node clustersAI-integrated CI/CD pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 6.1.2

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.

Exploitation Scenario

An attacker with low-privilege access to a host running an OpenClaw AI agent — obtained via a compromised service account, container escape, or malicious insider — triggers a local reconnection event in the shared-auth subsystem, for example by briefly disrupting the local network interface or injecting a reconnect signal into the IPC channel. OpenClaw's shared-auth mechanism, designed for seamless device re-pairing, silently auto-approves any pending scope-upgrade request without requiring human confirmation or generating a visible alert. This widens the attacker's paired device permissions from operator.read to operator.admin. The attacker then invokes privileged admin APIs or agent tool calls to execute arbitrary code on the node, exfiltrate model configurations and credentials stored in the agent environment, and use the compromised node as a pivot point to reach other systems accessible to the OpenClaw agent.

Weaknesses (CWE)

CWE-648 Incorrect Use of Privileged APIs

CWE-648 — Incorrect Use of Privileged APIs: The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

[Implementation] Before calling privileged APIs, always ensure that the assumptions made by the privileged code hold true prior to making the call.
[Architecture and Design] Know architecture and implementation weaknesses of the privileged APIs and make sure to account for these weaknesses before calling the privileged APIs to ensure that they can be called safely.

Source: MITRE CWE corpus.