EUVD-2026-87463

OpenClaw npm package 'openclaw' before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deployments that honor caller identity and...

CVE-2026-42432 OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute privileged commands on the local assistant system...

EUVD-2026-26134

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute privileged commands on the local assistant system...

CVE-2026-35631

OpenClaw vulnerable prior to version 2026.3.22: internal ACP chat commands fail to enforce operator.admin scope for mutating actions, allowing attackers without admin privileges to perform control-plane changes by direct command invocation. Impact: potential unauthorized modifications. Remediatio...