CVE-2026-35663: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35663 is a privilege escalation vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.3.25. The flaw allows non-admin operators to self-request broader scopes — specifically operator.admin — during a backend gateway reconnect, bypassing the normal pairing authorization requirements. It was published on April 10, 2026, with a patch released in version 2026.3.25. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is an incorrect use of privileged APIs (CWE-648) combined with improper privilege management (CWE-269) and incorrect authorization (CWE-863). The vulnerable code path involved a function shouldSkipBackendSelfPairing() in handshake-auth-helpers.ts that allowed gateway backend clients — identified by GATEWAY_CLIENT_IDS.GATEWAY_CLIENT and GATEWAY_CLIENT_MODES.BACKEND — to bypass the pairing requirement when connecting locally with shared-secret or device-token authentication. An attacker with a low-privilege operator token could initiate a backend-labeled reconnect request specifying operator.admin in the scopes field, and the server would grant the elevated scope without requiring pairing approval. The fix (commit d3d8e316) removes the shouldSkipBackendSelfPairing function entirely and enforces pairing whenever the requested scopes exceed the previously approved baseline (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated low-privilege operator to escalate to full operator.admin privileges without authorization, resulting in complete system compromise. An attacker gains unauthorized access to sensitive data, system configurations, and administrative controls, and can modify or delete critical information. Because the attack requires only network access and low-level credentials with no user interaction, any authenticated operator on a vulnerable deployment can exploit this flaw (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.037%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, GitHub Advisory).

1. Reconnaissance: Identify OpenClaw deployments running npm package versions ≤ 2026.3.24 by inspecting package.json or querying exposed gateway endpoints.
2. Obtain low-privilege credentials: Acquire a valid operator token with limited scopes (e.g., operator.read) through legitimate account registration or credential theft.
3. Initiate backend reconnect: Open a WebSocket connection to the OpenClaw gateway server and send a connect handshake request with the following crafted parameters: set client.id to GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT, client.mode to GATEWAY_CLIENT_MODES.BACKEND, role to operator, and scopes to ["operator.admin"].
4. Bypass pairing: On vulnerable versions, the server's shouldSkipBackendSelfPairing() logic skips the pairing requirement for backend-labeled clients authenticating with a shared secret or device token, granting the requested operator.admin scope without approval.
5. Achieve administrative access: The reconnect succeeds with operator.admin privileges, giving the attacker full administrative control over the OpenClaw instance, including access to all data and configuration (GitHub Advisory, GitHub Commit).

• Network: Unexpected WebSocket connection requests to the OpenClaw gateway from operator accounts with client.mode: BACKEND and scopes: ["operator.admin"] where the operator's approved baseline does not include operator.admin.
• Logs: Gateway access logs showing a successful reconnect granting operator.admin scope to an operator identity whose approvedScopes only contained lower-privilege scopes (e.g., operator.read); absence of a corresponding device.pair.requested event preceding the scope upgrade.
• Application State: Operator device records showing approvedScopes inconsistent with the active token scopes — e.g., approvedScopes: ["operator.read"] but active session scopes of ["operator.admin"].
• Behavioral: Administrative actions (configuration changes, data exports, user management) performed by operator accounts that were not previously granted admin privileges (GitHub Advisory, GitHub Commit).

Upgrade OpenClaw to version 2026.3.25 or later, which removes the shouldSkipBackendSelfPairing bypass and enforces pairing for any reconnect request where the requested scopes exceed the approved baseline. Until patching is complete, restrict network access to OpenClaw gateway endpoints and limit operator account permissions to only the minimum required scopes. Monitor backend reconnect activities for scope upgrade attempts from non-admin accounts as a detection measure (GitHub Advisory, GitHub Commit).

The vulnerability was reported by security researcher zpbrent and the advisory was published by steipete on the OpenClaw GitHub repository. A brief mention appeared on Mastodon via @thehackerwire shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).