Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.read requests to runtime operator.write permissions. Attackers can exploit this by sending read-scoped requests through the gateway auth route to gain unauthorized write access to runtime operations.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42429 Privilege Escalation in OpenClaw Gateway Plugin HTTP Authentication Before 2026.4.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42429
Post summary
A privilege escalation vulnerability in the OpenClaw Gateway Plugin was disclosed, impacting versions before 2026.4.8.
CVE-2026-42429 OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that widens identity-bearing http://operator.read … https://www.cve.org/CVERecord?id=CVE-2026-42429
Post summary
The post announces that OpenClaw versions prior to 2026.4.8 have a privilege escalation bug in the gateway plugin’s HTTP authentication, but does not include PoC code, exploitation details, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |