CVE-2026-35663: OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining unauthorized administrative privileges.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35663?
CVE-2026-35663 has a medium severity rating due to its potential impact on privileged access within the OpenClaw system.
How do I fix CVE-2026-35663?
To fix CVE-2026-35663, upgrade OpenClaw to version 2026.3.25 or later to mitigate the privilege escalation vulnerability.
Who is affected by CVE-2026-35663?
CVE-2026-35663 affects all versions of OpenClaw prior to version 2026.3.25, allowing non-admin operators to exploit the vulnerability.
What type of vulnerability is CVE-2026-35663?
CVE-2026-35663 is classified as a privilege escalation vulnerability that allows unauthorized access during backend reconnect.
What are the potential risks of CVE-2026-35663?
The risks associated with CVE-2026-35663 include unauthorized access and control over critical functions of the OpenClaw application by attackers.