OpenClaw Privilege Escalation Vulnerability in Device Pairing

A privilege escalation vulnerability has been identified in OpenClaw versions prior to 2026.3.22. During the initial device pairing process, bootstrap setup codes were not properly assigned to the correct device roles and scopes. This oversight allowed attackers to exploit the vulnerability and gain elevated privileges beyond what was intended for their assigned role and scope.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation during the device pairing process, enabling users to gain elevated rights and access within the application.

Reproduction

To reproduce this vulnerability, pair a device using an unbound bootstrap setup code that requests broader roles or scopes than those intended. This can be done by issuing a device bootstrap token that includes the desired roles and scopes, and then redeeming it during the pairing process.

Remediation

Users can update to OpenClaw version 2026.3.22 or later, where this vulnerability has been fixed.