Privilege Escalation Vulnerability in OpenClaw by OpenClaw

CVE-2026-35639

What is CVE-2026-35639?

OpenClaw, prior to version 2026.3.22, is susceptible to a privilege escalation vulnerability within the device.pair.approve method. This weakness permits an operator with the pairing approval role to authorize device requests with scopes that exceed their actual permissions. This insufficient scope validation may enable attackers to gain elevated privileges, potentially allowing them to escalate to an operator.admin level, which could lead to remote code execution within the Node infrastructure.

References