OpenClaw Privilege Escalation Vulnerability Allowing Remote Code Execution

A privilege escalation vulnerability has been identified in OpenClaw versions prior to 2026.3.31. This vulnerability allows paired nodes with the role of 'node' to send 'node.event' agent requests that bypass restrictions on gateway-side tool access. As a result, attackers with trusted paired node credentials can exploit this vulnerability to escalate privileges and execute remote code on the gateway.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, leading to remote code execution on the gateway.

Reproduction

The vulnerability can be reproduced by a paired node with the 'node' role. The node can dispatch 'node.event' agent requests to the gateway, using trusted credentials to gain unauthorized access to gateway-side tools. This unrestricted access can then be leveraged to execute code remotely on the gateway.

Remediation

Users can upgrade to OpenClaw version 2026.3.31 or later to address this vulnerability.