OpenClaw Silent Privilege Escalation via Implicit Auth Reconnect

Vulnerability Description

This vulnerability represents a critical privilege escalation via implicit authorization in OpenClaw's gateway shared-auth mechanism. The root cause is improper scope-upgrade validation during device reconnection flows. When a paired device reconnects to the gateway after network interruption, the system automatically re-establishes authentication without requiring explicit user approval for scope elevation. An attacker with initial operator.read permissions can silently transition to operator.admin scope, achieving unauthorized RCE on gateway-managed nodes. The vulnerability class is broken access control (CWE-284) combined with missing authorization checks (CWE-862).

PoC Significance

This disclosure proves that local reconnect pathways can bypass the intended pairing approval workflow. An attacker who has compromised or maintains access to a paired device with minimal read permissions can exploit transient network conditions (intentional disconnection/reconnection) to escalate privileges without triggering alerts or requiring new user interaction. The fix in commit 81ebc7e0344fd19c85778e883bad45e2da972229 confirms the issue was in the reconnect handler silently accepting scope widening—the PoC demonstrates the implicit-approval execution path is reachable and reliable.

Detection Guidance

Log Indicators:

• Auth scope changes during reconnect events without corresponding user pairing approvals
• Operator tokens showing permission elevation from read to admin in session logs
• Gateway reconnection events followed immediately by privileged node operations
• Multiple rapid reconnect attempts from the same device identifier

Monitoring Strategy: Track OpenClaw gateway logs for scope-upgrade requests lacking explicit approval_event markers. Monitor for devices with persistent operator.read that suddenly execute admin-level API calls.

Mitigation Steps

1. Immediate: Upgrade to openclaw >= 2026.3.25 where scope upgrades require explicit pairing approval
2. Temporary Workaround: Implement external rate limiting on reconnect actions per-device; disable auto-reconnect for non-interactive paired devices
3. Configuration Hardening: Enforce explicit re-authentication on scope elevation; require user MFA approval for any scope widening
4. Monitoring: Deploy detection logic flagging unauthorized scope transitions

Risk Assessment

This is high likelihood for exploitation in production IoT deployments. Local network access requirement limits exposed attack surface, but paired devices in shared environments (industrial, multi-tenant cloud gateways) are at elevated risk. Threat actors with initial device compromise or insider access will find this straightforward to exploit. The silent nature and lack of user-facing alerts make detection difficult without proper logging. Patch availability exists; however, legacy deployments and version pinning may leave systems vulnerable long-term.