Privilege Escalation in OpenClaw Enables Remote Code Execution

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.25 and involves a privilege escalation issue. Specifically, the software silently auto-approves local shared-auth reconnect requests that attempt to upgrade permissions from operator.read to operator.admin. This means that an attacker who can trigger a local reconnection can escalate their privileges without detection.

By exploiting this flaw, an attacker can gain higher-level permissions on the paired device, which can lead to remote code execution on the affected node.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is significant because it allows an attacker with local access to escalate their privileges silently from a lower permission level (operator.read) to a higher one (operator.admin).

This privilege escalation can lead to remote code execution on the node, potentially allowing the attacker to take full control of the device, manipulate data, disrupt operations, or use the device as a foothold for further attacks.

Useful 0 Not Useful 0