A critical privilege escalation vulnerability in OpenClaw allows authenticated users with pairing privileges to gain unauthorized administrative access, posing a significant risk to system security.

This is an authorization flaw (CWE-863) located in the /pair approve command path, where the application fails to forward caller scopes into the core approval check. An attacker who is already authenticated with pairing privileges can exploit this validation failure to approve device requests that grant administrative access.

Successful exploitation of this vulnerability allows an attacker to bypass intended access controls and achieve full administrative control over the OpenClaw environment. Given the high CVSS score of 8.1, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and the potential for lateral movement within the infrastructure.

Immediate Action: Update the OpenClaw software to version 2026.3.28 or later to incorporate the necessary scope validation fixes.

Proactive Monitoring: Review audit logs for the /pair approve command to identify unusual pairing activity or attempts by non-privileged accounts to approve administrative device requests.

Compensating Controls: Restrict access to the pairing functionality to a strictly limited set of trusted users until the patch can be applied to reduce the attack surface.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

The vulnerability represents a significant security oversight that directly facilitates privilege escalation. IT teams should prioritize the deployment of version 2026.3.28 immediately, as this update addresses the core authorization failure. Failure to patch leaves the administrative layer of the application exposed to any user with standard pairing capabilities.