What is the CVSS score?

9.9 on CVSS 3.1, 9.4 on CVSS 4.0.

What is CVE-2026-32922?

A critical privilege escalation (CVSS 9.9) in OpenClaw allowing a single API call to grant full admin access with RCE.

How is CVE-2026-32922 exploited?

Attacker with operator.pairing scope calls device.token.rotate requesting operator.admin — system mints elevated token without validation.

Which OpenClaw versions are affected?

All versions before 2026.3.11. Fix shipped March 13, 2026.

What can an attacker do?

Obtain operator.admin tokens and execute arbitrary commands on all connected nodes via system.run.

What is CVE-2026-32922?

A critical privilege escalation (CVSS 9.9) in OpenClaw allowing a single API call to grant full admin access with RCE.

How is CVE-2026-32922 exploited?

Attacker with operator.pairing scope calls device.token.rotate requesting operator.admin — system mints elevated token without validation.

Which OpenClaw versions are affected?

All versions before 2026.3.11. Fix shipped March 13, 2026.

What is the CVSS score?

9.9 on CVSS 3.1, 9.4 on CVSS 4.0.

What can an attacker do?

Obtain operator.admin tokens and execute arbitrary commands on all connected nodes via system.run.

← Back to dashboard

clawsmith.com/signal/cve-2026-32922-critical-privilege-escalation-cvss-9-9

⚠ IssueWide OpenLive

CVE-2026-32922: One API Call Grants Full Admin + RCE on OpenClaw (CVSS 9.9)

CVE-2026-32922, disclosed March 29 2026, is the most severe OpenClaw vulnerability to date (CVSS 9.9). A single API call to device.token.rotate with operator.pairing scope can mint operator.admin tokens, enabling remote code execution on all connected nodes. Fixed in v2026.3.11.

Product Idea from this Signal

A CLI tool that audits OpenClaw device token scopes and blocks privilege escalation paths before attackers exploit them

2.1k ▲

CVE-2026-32922 (CVSS 9.9) proved that a single API call to device.token.rotate can escalate any paired device to full admin. The root cause was missing scope validation, but the broader problem is that OpenClaw operators have zero visibility into which devices hold what scopes, which tokens have been rotated suspiciously, and whether their instance is still vulnerable. 137 security advisories were filed in 60 days. This CLI tool continuously audits device tokens, flags over-scoped devices, detects rotation anomalies, and blocks escalation attempts at the gateway level.

SECURITYCLIDEVTOOLOPEN-SOURCE

CompetitiveView Opportunity →