Privilege Escalation in OpenClaw Control UI via Unauthenticated Scope Abuse

Publication date: 2026-04-09

Last updated on: 2026-04-15

Assigner: VulnCheck

Description

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileged scopes without device identity verification. Attackers can exploit the device-less allow path in the trusted-proxy mechanism to maintain elevated permissions by declaring arbitrary scopes, bypassing device identity requirements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-15

Generated

2026-07-06

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-35638

EUVD

EUVD-2026-21132

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.3.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-286	The product does not properly manage a user within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.22 and involves a privilege escalation issue in the Control UI. It allows unauthenticated sessions to keep self-declared privileged scopes without verifying the device identity. Attackers can exploit a device-less allow path in the trusted-proxy mechanism to maintain elevated permissions by declaring arbitrary scopes, effectively bypassing device identity verification requirements.

Impact Analysis

The vulnerability can lead to unauthorized privilege escalation, allowing attackers to gain elevated permissions without proper authentication or device verification. This can result in unauthorized access to sensitive functions or data within the system, potentially compromising confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2026-35638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70