CVE-2026-35669

CVE-2026-35669 is a privilege escalation vulnerability affecting OpenClaw versions prior to 2026.3.25, wherein gateway-authenticated plugin HTTP routes incorrectly assign operator.admin runtime scope to all callers regardless of their actual permissions. This flaw allows attackers to bypass scope boundaries and gain unauthorized administrative privileges within the system. The vulnerability carries a HIGH severity rating with a CVSS score of 8.8, indicating significant risk across multiple impact dimensions. The attack requires network access and low privileges to initiate but demands no user interaction, and affects core system confidentiality, integrity, and availability with unrestricted scope impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is a straightforward attack with high consequences. Exploitation status indicates the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, and no public exploit code appears to be in active circulation. The EPSS score of 0.00044 suggests low probability of exploitation in the wild, though the FAUCET Risk Score of 52.0 indicates moderate organizational concern. Community attention remains minimal at this time, with the vulnerability classified as inactive on exploitation monitoring lists.