Privilege Escalation in OpenClaw Control UI Affects Unauthenticated Sessions

CVE-2026-35638

What is CVE-2026-35638?

OpenClaw prior to version 2026.3.22 contains a vulnerability in its Control UI that allows unauthorized sessions to maintain self-declared privileged scopes without proper device identity validation. Attackers can take advantage of the device-less path within the trusted-proxy mechanism to assert escalated permissions by arbitrarily declaring scopes, circumventing the necessary device identity checks. This vulnerability underscores the importance of robust authentication mechanisms to prevent unauthorized access and elevated privileges.

References