CVE-2026-35645

CVE-2026-35645 is a privilege escalation vulnerability affecting OpenClaw versions prior to 2026.3.25. The flaw exists in the gateway plugin subagent fallback deleteSession function, which improperly uses a synthetic operator.admin runtime scope, allowing attackers to execute privileged administrative operations without proper authorization. This vulnerability enables unauthorized administrative actions through session deletion mechanisms. The vulnerability carries a CVSS severity score of 8.8 (HIGH) with a network-based attack vector requiring only low complexity and low privileges to exploit. No user interaction is required for successful exploitation. The potential impact is severe, affecting confidentiality, integrity, and availability with high confidence across all affected systems. The attack requires a low-privileged authenticated user to trigger the session deletion function. There is currently no evidence of active exploitation in the wild, with no confirmation on the KEV catalog or active inclusion on industry hot lists. The EPSS score of 0.00044 indicates this vulnerability is less likely to be exploited compared to the general CVE population, though organizations should prioritize patching to OpenClaw 2026.3.25 or later given the high CVSS rating and the ease of exploitation for authenticated users.