VULNERABILITY INTELLIGENCE

CVE-2026-35625

CVSS score7.8 HIGH
EPSS probability0.19%
CISA KEVNot currently listed
Published2026-04-09
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.

Weakness classification

  • disclosure@vulncheck.com: CWE-648

Primary references