CVE-2026-35645: OpenClaw privilege escalation

CISO Take

OpenClaw before version 2026.3.25 contains a privilege escalation flaw in its gateway plugin's deleteSession function, where the subagent fallback logic activates a synthetic operator.admin runtime scope when invoked without a properly scoped request client, allowing any authenticated low-privilege user to assume administrative control over the agent environment. This is exploitable over the network with low complexity and no user interaction, making it accessible to compromised trial accounts, stolen API keys, or malicious insiders. The EPSS score places this in the top 80th percentile of likely-exploited vulnerabilities, and the package's history of 396 CVEs signals a pattern of security debt that threat actors actively probe—even without a public exploit or CISA KEV listing today. Organizations running OpenClaw-based agent deployments should upgrade to 2026.3.25 immediately or isolate the gateway plugin endpoint at the network layer and audit deleteSession invocations for missing request-scoped client identifiers.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High (CVSS 8.1). The combination of network attack vector, low access complexity, and only low-privilege requirements makes this exploitable by any authenticated adversary—including compromised service accounts or trial users. The synthetic operator.admin scope bypass is particularly damaging in AI agent environments where administrative access enables manipulation of orchestration logic, tool configurations, and multi-agent pipelines. The CVSS vector shows no direct confidentiality impact (C:N), but the privilege escalation itself unlocks secondary data access paths not captured in the base score. Absence of a public exploit and CISA KEV listing moderates immediate urgency, but the top-80th-percentile EPSS score and the package's history of 396 CVEs indicate this class of vulnerability is actively sought.

How does the attack unfold?

Initial Access

Adversary authenticates to the OpenClaw gateway using a valid low-privilege API credential obtained via credential stuffing, phishing, or a compromised trial account.

AML.T0012

Exploitation

Adversary sends a crafted deleteSession request to the gateway plugin endpoint intentionally omitting a request-scoped client context, triggering the subagent fallback code path.

AML.T0049

Privilege Escalation

The fallback logic substitutes the synthetic operator.admin runtime scope instead of rejecting the scopeless call, granting the adversary administrative-level control over the OpenClaw agent environment.

AML.T0053

Impact

Adversary manipulates or terminates other users' agent sessions, modifies tool configurations and orchestration pipelines, and invokes privileged agent tools to exfiltrate sensitive data or disrupt operations.

AML.T0086

Initial Access

Adversary authenticates to the OpenClaw gateway using a valid low-privilege API credential obtained via credential stuffing, phishing, or a compromised trial account.

AML.T0012

Exploitation

Adversary sends a crafted deleteSession request to the gateway plugin endpoint intentionally omitting a request-scoped client context, triggering the subagent fallback code path.

AML.T0049

Privilege Escalation

The fallback logic substitutes the synthetic operator.admin runtime scope instead of rejecting the scopeless call, granting the adversary administrative-level control over the OpenClaw agent environment.

AML.T0053

Impact

Adversary manipulates or terminates other users' agent sessions, modifies tool configurations and orchestration pipelines, and invokes privileged agent tools to exfiltrate sensitive data or disrupt operations.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

5 steps

Patch: Upgrade to OpenClaw 2026.3.25 or apply patch commit b5d785f1a5 from the official repository immediately.
Network isolation (if patching is blocked): Restrict access to the gateway plugin's deleteSession endpoint to trusted internal IPs via firewall or reverse-proxy ACLs—block all unauthenticated or externally originating requests.
Detection: Audit logs for deleteSession invocations where no request-scoped client identifier is present; these are anomalous and should trigger SIEM alerts.
Credential rotation: Rotate all API keys and service account credentials with access to the OpenClaw gateway, as post-escalation data access via agent tools cannot be ruled out.
Dependency audit: Identify all downstream packages and services consuming OpenClaw as a dependency and assess their exposure to the vulnerable code path.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.3 - Access control to AI systems

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk management

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35645?

OpenClaw before version 2026.3.25 contains a privilege escalation flaw in its gateway plugin's deleteSession function, where the subagent fallback logic activates a synthetic operator.admin runtime scope when invoked without a properly scoped request client, allowing any authenticated low-privilege user to assume administrative control over the agent environment. This is exploitable over the network with low complexity and no user interaction, making it accessible to compromised trial accounts, stolen API keys, or malicious insiders. The EPSS score places this in the top 80th percentile of likely-exploited vulnerabilities, and the package's history of 396 CVEs signals a pattern of security debt that threat actors actively probe—even without a public exploit or CISA KEV listing today. Organizations running OpenClaw-based agent deployments should upgrade to 2026.3.25 immediately or isolate the gateway plugin endpoint at the network layer and audit deleteSession invocations for missing request-scoped client identifiers.

Is CVE-2026-35645 actively exploited?

No confirmed active exploitation of CVE-2026-35645 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35645?

1. Patch: Upgrade to OpenClaw 2026.3.25 or apply patch commit b5d785f1a5 from the official repository immediately. 2. Network isolation (if patching is blocked): Restrict access to the gateway plugin's deleteSession endpoint to trusted internal IPs via firewall or reverse-proxy ACLs—block all unauthenticated or externally originating requests. 3. Detection: Audit logs for deleteSession invocations where no request-scoped client identifier is present; these are anomalous and should trigger SIEM alerts. 4. Credential rotation: Rotate all API keys and service account credentials with access to the OpenClaw gateway, as post-escalation data access via agent tools cannot be ruled out. 5. Dependency audit: Identify all downstream packages and services consuming OpenClaw as a dependency and assess their exposure to the vulnerable code path.

What systems are affected by CVE-2026-35645?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration, multi-agent systems, model serving.

What is the CVSS score for CVE-2026-35645?

CVE-2026-35645 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestrationmulti-agent systemsmodel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion without a request-scoped client to execute privileged operations with unintended administrative scope.

Exploitation Scenario

An adversary with a valid low-privilege API credential—obtained through phishing, credential stuffing against the trial signup flow, or a compromised service account—sends a crafted HTTP request to OpenClaw's gateway plugin targeting the deleteSession endpoint. The request is intentionally constructed without a request-scoped client context in the session payload. The gateway's subagent fallback code path is triggered, and instead of rejecting the scopeless call, the framework substitutes its synthetic operator.admin runtime scope. The adversary now operates with full administrative privileges: they enumerate and terminate other users' active agent sessions, inspect and modify agent tool configurations including credentials stored in agent context, and redirect orchestration pipelines to exfiltrate sensitive data or disrupt operations—all without any privileged account ever being provisioned for them.

Weaknesses (CWE)

CWE-648 Incorrect Use of Privileged APIs

CWE-648 — Incorrect Use of Privileged APIs: The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

[Implementation] Before calling privileged APIs, always ensure that the assumptions made by the privileged code hold true prior to making the call.
[Architecture and Design] Know architecture and implementation weaknesses of the privileged APIs and make sure to account for these weaknesses before calling the privileged APIs to ensure that they can be called safely.

Source: MITRE CWE corpus.