Disclosed vulnerability
CVE-2026-32922: OpenClaw device.token.rotate mints admin scopes from a pairing token, giving RCE on every connected node
AIR-2026-0081 AIR record · 2026-03-openclaw-device-token-rotate-privesc
From the supporting source
mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current scope set.github.com
The record
Disclosed
2026-03-29
Vendor
OpenClaw project
Product
OpenClaw gateway
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — a token-rotation API mints admin scopes from a pairing token
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Single api call from low scope token
Impact type
Privilege escalation, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
every OpenClaw version before 2026.3.11; ARMO counted ~135,000 internet-facing OpenClaw instances in February 2026, 63% without authentication
Capability abused
Defense & remediation
Recorded defense
scoped device tokens (operator.pairing vs operator.admin)
Guardrail kinds
Permission scope, Authentication
Guardrail outcome
Silent
Fix shipped
OpenClaw 2026.3.11 (fix merged 2026-03-13)
Taxonomy & references
Curator notes
GHSA-x8qx-w8w2-g4rx, CVSS 9.4 Critical, CWE-266. Reported 2026-02-19, fixed 2026-03-13, CVE published 2026-03-29. Part of a wider pairing/scope-subsetting family in the same window that is NOT merged here: CVE-2026-35639 (device.pair.approve approver-scope escalation, GHSA-hf68-49fm-59cq, Critical), CVE-2026-33579 (/pair approve omitted caller scope subsetting), CVE-2026-35663 (gateway backend reconnect self-claiming operator.admin), CVE-2026-32987 (replayable bootstrap setup codes). The recurring root cause across all of them is that OpenClaw's gateway repeatedly failed to subset scopes to the caller's own.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-32922: OpenClaw device.token.rotate mints admin scopes from a pairing token, giving RCE on every connected node". AIR, AIR-2026-0081. https://agentincident.vercel.app/i/AIR-2026-0081/ (accessed 2026-10-19).