Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can exploit insufficient scope validation to escalate privileges to operator.admin and achieve remote code execution on the Node infrastructure.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-09 | 3 | Disclosure2Patch1 |
| 2026-04-10 | 2 | Active Exploitation1Disclosure1 |
| 2026-04-12 | 1 | Disclosure1 |
🚨 LIVE HIJACK ALERT — CVE-2026-35639. CVSS 8.8. attackers approve their own device pairing requests with escalated scopes, walk straight to operator.admin, execute code on your node infrastructure. investigating. 🧵
Post summary
The post alerts that CVE-2026-35639 is actively exploited, enabling attackers to elevate privileges via device pairing and execute arbitrary code on node infrastructure.
🚨 TODAY'S TOP 3 AGENT THREATS — 1. ghost session privilege takeover (CVE-2026-35638) unauthenticated sessions self-declare admin scopes without device verification and your control UI just believes them 2. scope laundering via pairing approval (CVE-2026-35639) low-privilege operators approve device pairings with broader scopes than they hold, granting themselves capabilities they were never authorized for 3. reconnect-to-admin bypass (CVE-2026-35663) non-admin operators request admin scopes during backend reconnect and bypass pairing requirements entirely is your agent on the list? → http://agentcop.live #AgentSecurity #CVE
Post summary
A tweet announces three newly disclosed CVEs affecting agent software, providing brief technical descriptions of each vulnerability but not discussing exploits, patches, or active attacks.
CVE-2026-35639 Privilege Escalation in OpenClaw Before 2026.3.22 Device Pairing Approval https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35639
Post summary
A vulnerability (CVE-2026-35639) has been disclosed as a privilege escalation issue in OpenClaw devices before version 2026.3.22, with no PoC, patch, or exploitation claims mentioned.
[CVE-2026-35639: HIGH] Vulnerability alert: OpenClaw (pre-2026.3.22) has a privilege escalation flaw in device.pair.approve. Exploitation may lead to operator.admin rights & remote code execution. Update now!#cve,CVE-2026-35639,#cybersecurity https://cvefind.com/CVE-2026-35639
Post summary
The post alerts on a privilege escalation flaw in OpenClaw that could enable remote code execution, urging users to immediately apply a patch.
🚨*CVE* CVE-2026-35639 OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending … https://www.cve.org/CVERecord?id=CVE-2026-35639 ----- Traducción: CVE-2026-35639 Ope… http://infoflow.cloud`
Post summary
The post announces a privilege‑escalation vulnerability (CVE‑2026‑35639) in OpenClaw, providing a brief technical description and a link to the CVE record.
CVE-2026-35639 OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending … https://www.cve.org/CVERecord?id=CVE-2026-35639
Post summary
The entry describes a privilege escalation vulnerability in OpenClaw's device.pair.approve method, providing technical details but lacking PoC, exploit code, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |