CVE-2026-35639: OpenClaw scope bypass enables admin

CISO Take

OpenClaw's device pairing approval API (device.pair.approve) fails to validate that approvers cannot grant operator scopes they do not themselves hold, allowing any operator with pairing privileges to silently escalate to operator.admin. This is a network-exploitable, low-complexity flaw (CVSS 8.8) requiring only a valid low-privilege account and zero user interaction — making it practical for insider threats or compromised partner accounts to pivot to full infrastructure control. EPSS places this in the top 64% of likely-to-be-exploited vulnerabilities, and with RCE as the confirmed worst-case outcome, any OpenClaw deployment running a multi-operator model is at immediate risk. Patch to version 2026.3.22 or later immediately; if patching is delayed, revoke the operator.pairing role from all non-essential accounts and audit recently approved device pairings for anomalous scope assignments.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High risk. CVSS 8.8 with a network attack vector, low complexity, and no user interaction makes this trivially exploitable by any authenticated low-privilege operator. The path from initial access to remote code execution is direct and well-defined via a single API call. While CISA KEV is not yet populated and no public exploit exists, the EPSS top-64 percentile signals measurable exploitation probability. AI agent frameworks like OpenClaw typically run with elevated system privileges and broad tool access, amplifying the blast radius of any privilege escalation well beyond what a comparable standard web application would carry.

How does the attack unfold?

Initial Access

Attacker authenticates with a valid low-privilege operator.pairing account obtained through credential theft, insider access, or a compromised contractor or partner account.

AML.T0012

Exploitation

Attacker calls device.pair.approve on a self-controlled pending device request, injecting operator.admin into the scope field; OpenClaw's absent scope validation approves the elevated scope without verification.

AML.T0049

Privilege Escalation

Attacker's device is registered with operator.admin privileges, granting full administrative control over the OpenClaw Node.js runtime, its configuration, and all tool integrations.

AML.T0053

Impact — RCE and Lateral Movement

Attacker executes arbitrary commands on the Node infrastructure via the admin session, harvests credentials from agent configuration files, and pivots to connected AI pipelines and downstream services.

AML.T0072

Initial Access

Attacker authenticates with a valid low-privilege operator.pairing account obtained through credential theft, insider access, or a compromised contractor or partner account.

AML.T0012

Exploitation

Attacker calls device.pair.approve on a self-controlled pending device request, injecting operator.admin into the scope field; OpenClaw's absent scope validation approves the elevated scope without verification.

AML.T0049

Privilege Escalation

Attacker's device is registered with operator.admin privileges, granting full administrative control over the OpenClaw Node.js runtime, its configuration, and all tool integrations.

AML.T0053

Impact — RCE and Lateral Movement

Attacker executes arbitrary commands on the Node infrastructure via the admin session, harvests credentials from agent configuration files, and pivots to connected AI pipelines and downstream services.

AML.T0072

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch immediately to OpenClaw ≥2026.3.22 — fixes are in commits fc2d29ea and 630f1479 on GitHub.
If patching is delayed, revoke or suspend the operator.pairing role for all non-essential accounts as an interim containment measure.
Audit the devices table for any approved pairings where the granted scope exceeds the approver's own historical scope — flag anomalies for revocation and investigation.
Review Node process audit logs and agent activity logs for unexpected command executions correlated with device approval events.
Rotate all credentials and API keys stored in OpenClaw agent configuration files on any instance that may have been running an unpatched version with external operator accounts.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent API Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

Cl. 6.1.2 - AI risk assessment Cl. 8.4 - AI system documentation and controls

NIST AI RMF

GOVERN 1.7 - Processes for AI risk management

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35639?

OpenClaw's device pairing approval API (device.pair.approve) fails to validate that approvers cannot grant operator scopes they do not themselves hold, allowing any operator with pairing privileges to silently escalate to operator.admin. This is a network-exploitable, low-complexity flaw (CVSS 8.8) requiring only a valid low-privilege account and zero user interaction — making it practical for insider threats or compromised partner accounts to pivot to full infrastructure control. EPSS places this in the top 64% of likely-to-be-exploited vulnerabilities, and with RCE as the confirmed worst-case outcome, any OpenClaw deployment running a multi-operator model is at immediate risk. Patch to version 2026.3.22 or later immediately; if patching is delayed, revoke the operator.pairing role from all non-essential accounts and audit recently approved device pairings for anomalous scope assignments.

Is CVE-2026-35639 actively exploited?

No confirmed active exploitation of CVE-2026-35639 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35639?

1. Patch immediately to OpenClaw ≥2026.3.22 — fixes are in commits fc2d29ea and 630f1479 on GitHub. 2. If patching is delayed, revoke or suspend the operator.pairing role for all non-essential accounts as an interim containment measure. 3. Audit the devices table for any approved pairings where the granted scope exceeds the approver's own historical scope — flag anomalies for revocation and investigation. 4. Review Node process audit logs and agent activity logs for unexpected command executions correlated with device approval events. 5. Rotate all credentials and API keys stored in OpenClaw agent configuration files on any instance that may have been running an unpatched version with external operator accounts.

What systems are affected by CVE-2026-35639?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent infrastructure, multi-tenant AI operator environments, AI tool orchestration pipelines.

What is the CVSS score for CVE-2026-35639?

CVE-2026-35639 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.46%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent infrastructuremulti-tenant AI operator environmentsAI tool orchestration pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: Cl. 6.1.2, Cl. 8.4

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can exploit insufficient scope validation to escalate privileges to operator.admin and achieve remote code execution on the Node infrastructure.

Exploitation Scenario

An adversary with a legitimately provisioned operator.pairing account — obtained via credential theft, a phished employee, or a compromised contractor — calls the device.pair.approve API against a pending device request they control, injecting operator.admin into the scope field of the approval payload. Because OpenClaw does not verify that the approver holds the scopes being granted, the request succeeds and the attacker's device is registered with full admin privileges. The attacker then uses this admin session to interact with the OpenClaw Node infrastructure, deploys a reverse shell via the agent's tool execution capabilities, and pivots to connected systems — cloud storage, internal APIs, model inference endpoints — that the admin operator is authorized to reach. The entire kill chain requires only a low-privilege account and a single crafted API call.

Weaknesses (CWE)

CWE-648 Incorrect Use of Privileged APIs

CWE-648 — Incorrect Use of Privileged APIs: The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

[Implementation] Before calling privileged APIs, always ensure that the assumptions made by the privileged code hold true prior to making the call.
[Architecture and Design] Know architecture and implementation weaknesses of the privileged APIs and make sure to account for these weaknesses before calling the privileged APIs to ensure that they can be called safely.

Source: MITRE CWE corpus.