CVE-2026-35625
🟡 Monitoruj
Wzrost uprawnień w OpenClaw pozwala na zdalne wykonanie kodu przez nieautoryzowane połączenia.
CVSS
7.8
EPSS
0.0%
Exploit
none
Vendor
openclaw
Opis źródłowy (NVD)
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.
privilege-escalation rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.0% |
| Opublikowano (NVD) | 2026-04-09 22:16:30 UTC |
| Ostatnia modyfikacja (NVD) | 2026-04-16 13:43:35 UTC |
Referencje
- https://github.com/openclaw/openclaw/commit/81ebc7e0344fd19c85778e883bad45e2da972229 (disclosure@vulncheck.com) [Patch]
- https://github.com/openclaw/openclaw/security/advisories/GHSA-fqw4-mph7-2vr8 (disclosure@vulncheck.com) [Vendor Advisory]
- https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-silent-local-shared-auth-reconnect (disclosure@vulncheck.com) [Third Party Advisory]