OpenClaw Patches Critical Privilege Escalation in /pair Approve Path
Security Patch for OpenClaw Tool-Calling Layer
OpenClaw has released version 2026.3.28 to patch a critical privilege escalation vulnerability discovered by Ant AI Security Lab. This affects users running OpenClaw as a tool-calling layer for local LLMs.
Vulnerability Details
The vulnerability was in the /pair approve command path. Specifically, when calling device approval, the system failed to forward caller scopes into the core approval check. This allowed a user with pairing privileges (but not admin privileges) to approve a pending device request that asked for broader scopes, including admin access.
Version Information
- Affected versions: OpenClaw <= 2026.3.24
- Patched version: OpenClaw >= 2026.3.28
Security Implications
This vulnerability is particularly relevant for anyone running local LLMs with tool access through OpenClaw. If a model becomes prompt-injected and can issue commands on your behalf, this is exactly the type of path that could be exploited to gain elevated privileges.
The advisory identifier is GHSA-hc5h-pmr3-3497, and the full security advisory is available on GitHub.
📖 Read the full source: r/openclaw
👀 See Also
OpenClaw Security Concerns: API Keys and Conversation Data at Risk in Default Self-Hosting
A Cisco report indicates OpenClaw security is "optional, not built in," with default configurations storing API keys in .env files on VPS instances, creating potential exposure for non-technical users running on basic droplets.
Reddit user reports OpenClaw VM persistence and suspicious activity
A Reddit user reports their OpenClaw virtual machine automatically restarting after being closed and exhibiting suspicious behavior including opening Microsoft Store and attempting to download questionable files.
Clawvisor: Purpose-Based Authorization Layer for OpenClaw Agents
Clawvisor is an authorization layer that sits between AI agents and APIs, enforcing purpose-based authorization where agents declare intentions, users approve specific purposes, and an AI gatekeeper verifies every request against that purpose. Credentials never leave Clawvisor and agents never see them.
