A privilege escalation vulnerability in OpenClaw allows previously paired nodes to bypass authorization checks, potentially leading to unauthorized command execution on the local assistant system.

This is an incorrect authorization flaw (CWE-863) where the application fails to enforce the operator.admin scope requirement during node reconnection. An attacker with existing low-level node access can bypass re-pairing authentication to gain elevated command execution capabilities.

The ability to execute unauthorized privileged commands on the local assistant system poses a critical risk to system integrity and operational security. With a CVSS score of 7.8, this high-severity vulnerability could allow an attacker to gain full control over the local node, potentially leading to unauthorized data access or disruption of critical business processes.

Immediate Action: Update the OpenClaw package to version 2026.4.8 or later to enforce proper scope validation during node reconnection.

Proactive Monitoring: Review system and application access logs for unexpected node reconnection events or commands executed by unauthorized node identifiers.

Compensating Controls: Implement strict network segmentation to limit which nodes can communicate with the local assistant system, thereby reducing the potential attack surface for re-pairing bypass attempts.

Public Exploit Available: Unknown

Given the potential for privilege escalation and unauthorized command execution, organizations should prioritize updating to version 2026.4.8 immediately. Administrators must ensure that all nodes are accounted for and that access controls are strictly maintained to prevent unauthorized nodes from leveraging this authorization bypass.