A critical privilege escalation vulnerability in OpenClaw allows authenticated attackers to bypass security controls and gain unauthorized administrative access.

The software suffers from an incorrect authorization flaw (CWE-863) where an attacker with valid shared gateway authentication can present a self-signed unpaired device identity to self-assign elevated operator scopes before pairing approval is granted.

Successful exploitation permits an attacker to assume the identity of an administrator, leading to full control over the affected gateway and connected systems. Given the CVSS score of 8.8, this poses a high risk of unauthorized data access, system disruption, and loss of integrity for the affected environment.

Immediate Action: Update the OpenClaw package to version 2026.2.25 or later immediately.

Proactive Monitoring: Review system access logs for anomalous pairing requests or unauthorized changes to account roles and permissions.

Compensating Controls: Restrict access to the shared gateway infrastructure to trusted networks and implement strict monitoring of authentication events to detect suspicious identity assertions.

Public Exploit Available: No

The severity of this vulnerability, combined with the potential for full administrative takeover, necessitates immediate patching. Organizations running OpenClaw should prioritize upgrading to version 2026.2.25 to prevent potential exploitation of the authorization bypass mechanism.