A privilege escalation vulnerability in OpenClaw allows authenticated node-level attackers to achieve remote code execution on the gateway, posing a critical risk to system integrity.

This vulnerability, categorized as CWE-862 (Missing Authorization), allows an attacker with trusted paired node credentials to dispatch node.event agent requests that bypass gateway-side security checks. By leveraging these unrestricted requests, a low-privileged node can escalate to remote code execution on the gateway.

The ability for a compromised or malicious node to execute arbitrary code on the gateway infrastructure represents a complete loss of confidentiality, integrity, and availability for the affected system. Given the CVSS score of 8.8, this vulnerability is classified as High severity and could allow an attacker to pivot into the internal network, exfiltrate sensitive data, or disrupt critical business operations.

Immediate Action: Update the OpenClaw package to version 2026.3.31 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review system and gateway logs for unusual node.event dispatch patterns or unexpected agent-initiated commands originating from authorized node credentials.

Compensating Controls: Restrict network access to the gateway to only essential services and implement strict segmentation between node-level infrastructure and the core gateway management plane.

Public Exploit Available: Unknown.

Organizations utilizing OpenClaw must prioritize the upgrade to version 2026.3.31 to remediate this authorization flaw. Because this vulnerability facilitates remote code execution upon the gateway, failure to patch leaves the entire management infrastructure susceptible to full system compromise by any compromised node.