Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.22 and involves a privilege escalation issue in the Control UI. It allows unauthenticated sessions to keep self-declared privileged scopes without verifying the device identity. Attackers can exploit a device-less allow path in the trusted-proxy mechanism to maintain elevated permissions by declaring arbitrary scopes, effectively bypassing device identity verification requirements.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized privilege escalation, allowing attackers to gain elevated permissions without proper authentication or device verification. This can result in unauthorized access to sensitive functions or data within the system, potentially compromising confidentiality, integrity, and availability.

Useful 0 Not Useful 0