A vulnerability in OpenClaw allows authenticated users to perform unauthorized privilege escalation to administrative levels, posing a high risk to system integrity.

This flaw involves incorrect authorization (CWE-863) within the trusted-proxy authentication mode, where scope-clearing is incomplete. An attacker with low privileges can declare operator scopes on non-Control-UI clients to maintain elevated permissions across identity-bearing paths.

Successful exploitation allows an attacker to gain operator.admin privileges, which grants full control over the affected system. This compromise of authorization controls can lead to unauthorized data access, system manipulation, and complete administrative takeover, justifying the CVSS score of 8.8.

Immediate Action: Update the OpenClaw package to version 2026.3.31 or later via your package manager to resolve the authorization flaw.

Proactive Monitoring: Review authentication and authorization logs for anomalous scope declarations or unexpected administrative access patterns by low-privileged accounts.

Compensating Controls: If immediate patching is not feasible, restrict access to the affected environment to trusted networks only and disable trusted-proxy authentication mode if possible.

Public Exploit Available: Unknown.

Given the potential for full administrative compromise, administrators should prioritize updating to version 2026.3.31 immediately. Organizations using OpenClaw in trusted-proxy configurations are at the highest risk and should ensure that all identity-bearing paths are protected by the latest security patches.