OpenClaw Gateway: Privilege Escalation via Insufficient Scope Validation in Device Pairing Approval

Vulnerability Description

This is a horizontal privilege escalation vulnerability rooted in insufficient authorization scope validation. The device.pair.approve method failed to restrict approved operator scopes to those held by the approver. An operator.pairing holder—intended only to approve pairing requests—could invoke this method to approve device registrations that granted operator.admin or higher scopes to the requester. This is a classic insecure direct object reference (IDOR) combined with authorization bypass, allowing unprivileged operators to create administrative accounts or escalate existing ones.

Proof-of-Concept Significance

The PoC demonstrates that scope inheritance and validation were not properly enforced at the gateway level. The vulnerability exists in the server-side method handler, making it reliably exploitable by any authenticated operator with pairing permissions. Preconditions are minimal: (1) attacker holds operator.pairing scope, (2) a pending device pair request exists or can be created, (3) gateway accepts the approval with elevated scopes. The low barrier to entry and direct method invocation make this highly reliable. Once exploited, the attacker gains RCE capability through administrative scope, representing critical business impact.

Detection Guidance

Defend by monitoring:

• Log analysis: Search gateway audit logs for device.pair.approve calls where the approver's declared scopes don't include scopes being granted to the device/operator being approved.
• Behavioral detection: Flag approvals where requestedScopes > approverScopes in any device pairing transaction.
• Access logs: Correlate operator.pairing role assignments with subsequent operator.admin account creations within short time windows.
• API telemetry: Alert on scope escalation patterns in device registration workflows, especially when approvals bypass normal hierarchical scope constraints.

Mitigation Steps

1. Patch immediately: Upgrade to openclaw >= 2026.3.22 (verified in v2026.3.23-2).
2. Code review focus: Verify that src/gateway/server-methods/devices.ts now threads caller scopes into approval logic and src/infra/device-pairing.ts enforces scope ceiling validation.
3. Temporary workaround (pre-patch): Restrict operator.pairing role assignments to users who already hold elevated scopes, or disable device auto-approval workflows.
4. Audit active operators: Review all approved device requests and operator account creations from accounts with pairing-only permissions for the past 90 days; revoke suspicious admin grants.

Risk Assessment

This vulnerability poses critical risk in production deployments. The exploit requires no sophisticated tooling—a simple authenticated API call suffices. Threat actors with low-level access (e.g., compromised service accounts, insider threats, or phished credentials) can achieve immediate RCE and full gateway compromise. The unpatched attack surface likely existed for an extended period, increasing likelihood of exploitation in the wild. Organizations should prioritize patching and forensic review; this vulnerability is an attractive target for privilege escalation chains in multi-tenant or federated identity scenarios.