Compliance Impact

The provided information does not specify how CVE-2026-32922 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-32922 is a critical privilege escalation vulnerability in OpenClaw versions before 2026.3.11. It occurs in the device.token.rotate function, which allows a caller with the operator.pairing scope to mint new device tokens with broader privileges than they are authorized for. This happens because the function validates requested scopes against the target device’s approved scopes but does not restrict them to the caller’s current scopes. As a result, an attacker can escalate their privileges by creating operator.admin tokens for paired devices without initially having administrative rights.

This escalation can lead to unauthorized administrative access and, in environments with connected nodes or companion apps exposing system.run, allows remote code execution on those nodes. Even without connected nodes, the attacker can gain unauthorized gateway-admin access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized privilege escalation to administrative levels on paired devices. Attackers can gain operator.admin tokens, allowing them to perform administrative actions without permission.

In deployments where connected nodes or companion applications expose system.run, attackers can execute remote code on those nodes, potentially compromising the entire system. Even in the absence of connected nodes, attackers can obtain unauthorized gateway-admin access, leading to full control over the gateway device.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenClaw to version 2026.3.11 or later, where the device.token.rotate function has been fixed to restrict newly minted token scopes to be a subset of the caller's existing scopes, preventing privilege escalation.

This update addresses the critical privilege escalation flaw that allowed attackers with operator.pairing scope to mint tokens with broader privileges, including operator.admin tokens, which could lead to unauthorized administrative access and remote code execution.

Useful 0 Not Useful 0