A privilege escalation vulnerability in OpenClaw became the subject of significant debate on Hacker News this weekend, with the original post sparking hundreds of comments and a direct response from OpenClaw creator Peter Steinberger. Here's what actually happened, what the risk level is, and what you need to do right now.
The Vulnerability: Scope-Ceiling Bypass
The bug is a scope-ceiling bypass in OpenClaw's pairing and command handler paths. Steinberger described it directly on HN:
"The root issue was an incomplete fix. The earlier advisory hardened the gateway RPC path for device approvals by passing the caller's scopes into the core approval check. But the
/pair approveplugin command path still called the same approval function withoutcallerScopes, and the core logic failed open when that parameter was missing."
In plain terms: a client that already had gateway write-level access could use the /pair approve latest command to approve a pending device request for broader scopes — including operator.admin. This is a privilege escalation from "authorized user" to "admin," not an exploit that lets strangers in from cold.
What the HN Discussion Got Wrong (and Right)
A Reddit post that seeded the HN discussion claimed that 135,000 OpenClaw instances are publicly exposed, and that 63% run zero authentication. These numbers were disputed throughout the thread — no credible citation was ever provided for them, and Steinberger noted that OpenClaw's default setup makes it difficult to run without auth and explicit device pairing.
That said, the underlying concern is legitimate. The bug is real. The scope of the exploitable population is smaller than the initial framing suggested, but:
- If your instance has multiple users with varying permission levels, you're in the most at-risk group
- If your instance is publicly accessible on the internet, the attack surface is higher
- Single-user personal assistant installations have very low practical risk
The Fix
This has been addressed in recent releases. OpenClaw's v2026.4.5 changelog (released April 6) includes security fixes that:
- Preserve restrictive plugin-only tool allowlists
- Require owner access for
/allowlist addand/allowlist removecommands - Fail closed when
before_tool_callhooks crash - Block browser SSRF redirect bypasses earlier
- Keep non-interactive auth-choice inference scoped to bundled and already-trusted plugins
If you're running an older version, update now. Run:
npm install -g openclaw@latest
openclaw doctor --fix
Hardening Your Installation
Regardless of the specific CVE, this is a good moment to audit your setup:
Authentication: Ensure your instance requires authentication. Run openclaw doctor and look for warnings about open auth configurations.
Exposure: OpenClaw should not be publicly reachable without a VPN or Tailscale tunnel. If you're hosting on a VPS, firewall your gateway port and access it only over a secure channel.
Multi-user setups: Review your paired devices with openclaw devices list and revoke any you don't recognize. Ensure users have the minimum permission scopes necessary.
Exec policy: Check ~/.openclaw/exec-approvals.json to make sure your security defaults are set appropriately. The v2026.4.5 release also fixed an issue where malformed values in this file could cause runtime policy failures.
Security Hardening in Progress
Steinberger noted that OpenClaw is "working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI." This generated its own thread of skepticism on HN, but it's consistent with the pattern of contributions visible in the public GitHub — the recent security-focused PRs (#58476, #59836, #59822, #58771, #59120) all came from contributors across different organizations.
The OpenClaw security advisory page at github.com/openclaw/openclaw/security is the canonical place to track disclosed vulnerabilities.
Bottom Line
This is a real vulnerability that has been fixed. The risk for single-user installations is low. For multi-user or publicly exposed instances, update immediately and review your auth configuration. Running openclaw doctor --fix will catch most configuration issues automatically.