https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T21:09:50.641655+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-35663 CVE-2026-35663 — OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim 2026-09-29T21:09:51.185944+00:00

Affected: OpenClaw

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining unauthorized administrative privileges.

 https://vulnerability.circl.lu/vuln/ghsa-9hjh-fr4f-gxc4 GHSA-9hjh-fr4f-gxc4 — OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin 2026-09-29T21:09:51.186112+00:00

Affected: npm: openclaw

## Summary

Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

## Affected Packages / Versions

- Package: `openclaw` - Affected versions: `<= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24`

## Details

Backend-labeled reconnects could previously self-request broader scopes and bypass pairing, allowing non-admin operators to reconnect as `operator.admin`. Commit `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48` removes the backend self-pairing skip and requires pairing when requested scopes exceed the approved baseline.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48`.

## Fix Commit(s)

- `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48`