OpenClaw Patches Critical Privilege Escalation in /pair Approve Path
Security Patch for OpenClaw Tool-Calling Layer
OpenClaw has released version 2026.3.28 to patch a critical privilege escalation vulnerability discovered by Ant AI Security Lab. This affects users running OpenClaw as a tool-calling layer for local LLMs.
Vulnerability Details
The vulnerability was in the /pair approve command path. Specifically, when calling device approval, the system failed to forward caller scopes into the core approval check. This allowed a user with pairing privileges (but not admin privileges) to approve a pending device request that asked for broader scopes, including admin access.
Version Information
- Affected versions: OpenClaw <= 2026.3.24
- Patched version: OpenClaw >= 2026.3.28
Security Implications
This vulnerability is particularly relevant for anyone running local LLMs with tool access through OpenClaw. If a model becomes prompt-injected and can issue commands on your behalf, this is exactly the type of path that could be exploited to gain elevated privileges.
The advisory identifier is GHSA-hc5h-pmr3-3497, and the full security advisory is available on GitHub.
📖 Read the full source: r/openclaw
👀 See Also
Security Analysis of Extracting OpenClaw Components for Custom AI Agents
A developer analyzed OpenClaw's source code to determine which components can be safely extracted for use in custom AI agents, scoring each using the Lethal Quartet framework. The analysis reveals significant security risks in components like Semantic Snapshots and BrowserClaw.
MCPwner AI Pentesting Tool Finds Multiple 0-Day Vulnerabilities in OpenClaw
MCPwner, an MCP server that orchestrates AI agents for automated penetration testing, identified several critical 0-day vulnerabilities in OpenClaw including environment variable injection, permission bypass, and information disclosure flaws that standard scanners missed.
AI-Built Apps Are Fragile: Why Small Changes Break Data Isolation and Permissions
Developers report that AI-generated apps (via Claude Code, Cursor) silently break login, permissions, and data isolation when small changes are made, because AI models lack understanding of original system intent like ownership rules.
Cisco source code stolen via Trivy supply chain attack
Cisco's internal development environment was breached using stolen credentials from the Trivy supply chain attack, resulting in the theft of source code from over 300 GitHub repositories including AI-powered products and customer code.