{"id":"CVE-2026-32042","aliases":["GHSA-553v-f69r-656j"],"url":"https://o3.security/vulnerability/CVE-2026-32042","summary":"OpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication","details":"### Summary\nA client using shared gateway auth could attach an unpaired device identity and request elevated operator scopes (including `operator.admin`) before pairing approval, enabling privilege escalation.\n\n### Impact\nAttackers with valid shared gateway auth could self-assign higher operator scopes by presenting a self-signed, unpaired device identity.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `>= 2026.2.22 <= 2026.2.24`\n- Latest published npm at triage time: `2026.2.24`\n- Planned patched release: `2026.2.25`\n\n### Remediation\nRequire pairing for operator device-identity sessions authenticated with shared token/password auth (except existing control-ui trusted-proxy/control-ui bypass policy paths).\n\n### Fix Commit(s)\n- `8d1481cb4a9d31bd617e52dc8c392c35689d9dea`\n\n### Release Process Note\n`patched_versions` is pre-set to the release (`>= 2026.2.25`). Advisory published with npm release `2026.2.25`.\n\nOpenClaw thanks @tdjackey for reporting.","published":"2026-03-21T00:42:17.500Z","modified":"2026-10-21T02:30:32.375739328Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.25"}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/8d1481cb4a9d31bd617e52dc8c392c35689d9dea","label":"openclaw/openclaw@8d1481c"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32042.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-553v-f69r-656j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32042"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unpaired-device-identity-in-shared-gateway-authentication"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/8d1481cb4a9d31bd617e52dc8c392c35689d9dea"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:32.375739328Z"}}