OpenClaw privilege-escalation bug | Hacker News

OpenClaw has a privilege-escalation bug caused by an incomplete fix that left checks partially unaddressed.

An earlier advisory added callerScopes into the core approval check for the gateway RPC path, but the /pair approve plugin command path did not pass callerScopes.

Missing callerScopes caused the core approval logic to fail open, allowing a gateway-access client to use chat.send with /pair approve to grant broader scopes, including operator.admin.

The flaw is in the shared plugin command handler, not Telegram-specific; Telegram DMs default to blocking unknown outsiders before command execution, and an already-authorized Telegram sender could reach the vulnerable path.

Practical risk is said to be low for single-user setups, but 135k+ instances are publicly exposed, 63% of those run zero authentication, the CVE notes low privilege required, and the fix involved collaboration with Nvidia, ByteDance, Tencent, and OpenAI.