CVE-2026-32042 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.25 contains a privilege escalation vulnerability caused by unpaired device identities bypassing operator pairing in authentication, letting attackers with valid shared gateway authentication self-assign elevated operator scopes, exploit requires valid shared gateway authentication.

Severity & Score

Impact

Attackers with valid shared gateway authentication can escalate privileges to operator.admin, compromising system control.

Mitigation

Update to version 2026.2.25 or later.

References

• https://github.com/openclaw/openclaw/commit/8d1481cb4a9d31bd617e52dc8c392c35689d9dea
• https://github.com/openclaw/openclaw/security/advisories/GHSA-553v-f69r-656j
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unpaired-device-identity-in-shared-gateway-authentication

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 21, 2026

🟠 CVE-2026-32042 - High (8.8) OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-assign elevated operator scopes including operator.admin. Attackers wi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32042/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner