CVE-2026-32922 — OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in…¶

Key facts

CVE-2026-32922 is a Critical (9.9) vulnerability: OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-32922
Severity	Critical (9.9)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32922/

Details¶

CVE-2026-32922 is a Critical (9.9) vulnerability: OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current scope set. Attackers can obtain operator.admin tokens for paired devices and achieve remote code execution on connected nodes via system.run or gain unauthorized gateway-admin access.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-32922
Type	RCE
CVSS Score	9.9

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32922/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-32922

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/security/advisories/GHSA-4jpw-hj22-2xmc
https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unvalidated-scope-in-device-token-rotate

Generated by PoC Generator on 2026-04-10T15:54:07.404748084

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-32922, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-32922 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"OpenClaw CVE-2026-32922 RCE via device.token.rotate privilege escalation"; content:"device.token.rotate"; content:"operator.pairing"; content:"operator.admin"; classtype:attempted-admin; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any any (msg:"OpenClaw CVE-2026-32922 RCE attempt via system.run"; content:"system.run"; content:"operator.admin"; classtype:shellcode-detect; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"OpenClaw CVE-2026-32922 gateway-admin unauthorized access"; content:"gateway-admin"; content:"device.token.rotate"; classtype:attempted-admin; sid:1000002; rev:1; priority:1;)

alert tcp any any -> any any (msg:"OpenClaw CVE-2026-32922 token minting scope escalation"; content:"token"; content:"mint"; content:"scope"; content:"operator"; classtype:policy-violation; sid:1000003; rev:1; priority:2;)

alert tcp any any -> any any (msg:"OpenClaw CVE-2026-32922 paired device exploitation"; content:"paired"; content:"device"; content:"token.rotate"; content:"admin"; classtype:attempted-admin; sid:1000004; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32922_OpenClaw_Token_Escalation {
    meta:
        author = "Security Engineer"
        description = "Detects exploitation attempts for CVE-2026-32922 OpenClaw privilege escalation vulnerability"
        cve = "CVE-2026-32922"
        date = "2024-01-01"
        reference = "OpenClaw device.token.rotate privilege escalation"
        severity = "high"

    strings:
        $api_endpoint1 = "device.token.rotate" ascii wide
        $api_endpoint2 = "/api/device/token/rotate" ascii wide
        $scope_operator_pairing = "operator.pairing" ascii wide
        $scope_operator_admin = "operator.admin" ascii wide
        $scope_gateway_admin = "gateway-admin" ascii wide
        $system_run = "system.run" ascii wide

        $exploit_pattern1 = "scope" ascii wide nocase
        $exploit_pattern2 = "mint" ascii wide nocase
        $exploit_pattern3 = "token" ascii wide nocase

        $jwt_header = /eyJ[A-Za-z0-9+\/=]+\.eyJ[A-Za-z0-9+\/=]+\.[A-Za-z0-9+\/=_-]+/

        $privilege_escalation1 = /"scope":\s*\[\s*"operator\.admin"/ ascii
        $privilege_escalation2 = /"scope":\s*\[\s*"gateway-admin"/ ascii

        $version_vulnerable = /OpenClaw.*[12][0-9]{3}\.[0-2]\./ ascii
        $version_pattern = /version.*2026\.[0-2]\./ ascii wide nocase

    condition:
        (
            $api_endpoint1 or $api_endpoint2
        ) and (
            $scope_operator_pairing and ($scope_operator_admin or $scope_gateway_admin)
        ) and (
            all of ($exploit_pattern*)
        ) or (
            $jwt_header and ($privilege_escalation1 or $privilege_escalation2)
        ) or (
            $system_run and any of ($scope_operator_admin, $scope_gateway_admin) and $exploit_pattern3
        ) or (
            ($version_vulnerable or $version_pattern) and $api_endpoint1 and any of ($scope_*)
        )
}

rule CVE_2026_32922_OpenClaw_Memory_Artifacts {
    meta:
        author = "Security Engineer"
        description = "Detects in-memory artifacts of CVE-2026-32922 OpenClaw exploitation"
        cve = "CVE-2026-32922"
        date = "2024-01-01"
        reference = "OpenClaw token scope escalation memory indicators"
        severity = "medium"

    strings:
        $mem_token_rotate = { 64 65 76 69 63 65 2E 74 6F 6B 65 6E 2E 72 6F 74 61 74 65 }
        $mem_operator_pairing = { 6F 70 65 72 61 74 6F 72 2E 70 61 69 72 69 6E 67 }
        $mem_operator_admin = { 6F 70 65 72 61 74 6F 72 2E 61 64 6D 69 6E }
        $mem_gateway_admin = { 67 61 74 65 77 61 79 2D 61 64 6D 69 6E }
        $mem_system_run = { 73 79 73 74 65 6D 2E 72 75 6E }

        $scope_array_start = { 22 73 63 6F 70 65 22 3A 5B }
        $jwt_bearer = { 42 65 61 72 65 72 20 65 79 4A }

        $escalation_indicator1 = /"current_scope".*"operator\.pairing".*"requested_scope".*"operator\.admin"/
        $escalation_indicator2 = /"token_type".*"escalated"/

    condition:
        3 of ($mem_*) or
        (
            $scope_array_start and 
            ($mem_operator_admin or $mem_gateway_admin) and
            $mem_operator_pairing
        ) or
        (
            $jwt_bearer and any of ($escalation_indicator*)
        )
}

rule CVE_2026_32922_OpenClaw_Log_Signatures {
    meta:
        author = "Security Engineer"
        description = "Detects log entries indicative of CVE-2026-32922 exploitation attempts"
        cve = "CVE-2026-32922"
        date = "2024-01-01"
        reference = "OpenClaw privilege escalation log patterns"
        severity = "medium"

    strings:
        $log_token_rotate = "device.token.rotate" ascii wide
        $log_scope_mismatch = /scope.*mismatch.*operator\.(pairing|admin)/ ascii wide nocase
        $log_token_mint = /token.*mint.*scope.*escalat/ ascii wide nocase
        $log_unauthorized_scope = /unauthorized.*scope.*request/ ascii wide nocase
        $log_privilege_escalation = /privilege.*escalat.*token/ ascii wide nocase

        $error_scope_validation = "scope validation failed" ascii wide nocase
        $error_token_constraint = "token constraint violation" ascii wide nocase

        $audit_admin_access = /admin.*access.*granted.*operator\.pairing/ ascii wide nocase
        $audit_system_run = /system\.run.*executed.*escalated/ ascii wide nocase

    condition:
        $log_token_rotate and (
            any of ($log_scope_mismatch, $log_token_mint, $log_unauthorized_scope, $log_privilege_escalation) or
            any of ($error_*) or
            any of ($audit_*)
        )
}

:material-file-download: prevention/yara.yar

# CVE-2026-32922 Prevention Rules - OpenClaw Token Privilege Escalation

# Block device.token.rotate API endpoint for unauthorized access
location ~* ^/api/.*device\.token\.rotate {
    # Block requests without proper authentication headers
    if ($http_authorization = "") {
        return 403;
    }

    # Block requests attempting to escalate to operator.admin scope
    if ($request_body ~* "operator\.admin") {
        return 403;
    }

    # Block requests attempting to escalate to gateway-admin scope
    if ($request_body ~* "gateway[_-]?admin") {
        return 403;
    }

    # Block requests with suspicious scope elevation patterns
    if ($request_body ~* "scope.*(\[|\{).*admin") {
        return 403;
    }

    # Add security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";

    # Log suspicious requests
    access_log /var/log/nginx/cve_2026_32922_attempts.log combined;

    # Continue to backend only if checks pass
    proxy_pass http://backend;
}

# Block system.run API calls that could lead to RCE
location ~* ^/api/.*system\.run {
    # Restrict to localhost only for system.run calls
    allow 127.0.0.1;
    deny all;

    # Additional header validation
    if ($http_user_agent ~* "(curl|wget|python|powershell)") {
        return 403;
    }

    access_log /var/log/nginx/system_run_blocked.log combined;
}

# General token manipulation endpoint protection
location ~* ^/api/.*(token|auth|oauth) {
    # Rate limiting for token endpoints
    limit_req zone=token_limit burst=5 nodelay;

    # Block malformed JSON in request body
    if ($request_body ~* "[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]") {
        return 400;
    }

    # Block scope manipulation attempts in any token endpoint
    if ($request_body ~* "(scope.*=.*admin|admin.*scope|escalate|privilege)") {
        return 403;
    }

    # Require specific content type
    if ($content_type !~* "application/(json|x-www-form-urlencoded)") {
        return 415;
    }

    add_header X-Content-Type-Options nosniff;
    proxy_pass http://backend;
}

# Block pairing scope abuse attempts
location ~* ^/api/.*(pair|pairing) {
    # Block requests trying to abuse operator.pairing scope
    if ($request_body ~* "operator\.pairing.*admin") {
        return 403;
    }

    # Validate pairing token format
    if ($http_authorization ~* "Bearer\s+[^A-Za-z0-9\-\._~\+\/]") {
        return 403;
    }

    limit_req zone=pairing_limit burst=3 nodelay;
    access_log /var/log/nginx/pairing_attempts.log combined;
    proxy_pass http://backend;
}

# Rate limiting zones (add to http block)
# limit_req_zone $binary_remote_addr zone=token_limit:10m rate=10r/m;
# limit_req_zone $binary_remote_addr zone=pairing_limit:10m rate=5r/m;

:material-file-download: prevention/nginx.conf

# CVE-2026-32922: OpenClaw Privilege Escalation via device.token.rotate
# Block unauthorized token rotation attempts and scope escalation

# Rule 1000000: Block device.token.rotate API calls from non-admin sources
SecRule REQUEST_URI "@contains device.token.rotate" \
    "id:1000000,\
    phase:2,\
    block,\
    severity:CRITICAL,\
    msg:'CVE-2026-32922: Blocked OpenClaw device.token.rotate API access',\
    logdata:'URI: %{REQUEST_URI}, IP: %{REMOTE_ADDR}',\
    tag:'attack-rce',\
    tag:'cve-2026-32922'"

# Rule 1000001: Block requests attempting to mint tokens with elevated scopes
SecRule ARGS "@rx (?:operator\.admin|gateway-admin|system\.run)" \
    "id:1000001,\
    phase:2,\
    block,\
    severity:CRITICAL,\
    msg:'CVE-2026-32922: Blocked attempt to mint elevated scope tokens',\
    logdata:'Suspicious scope parameter: %{MATCHED_VAR}',\
    tag:'attack-privilege-escalation',\
    tag:'cve-2026-32922'"

# Rule 1000002: Block system.run command execution attempts
SecRule REQUEST_URI "@contains system.run" \
    "id:1000002,\
    phase:2,\
    block,\
    severity:CRITICAL,\
    msg:'CVE-2026-32922: Blocked OpenClaw system.run command execution',\
    logdata:'URI: %{REQUEST_URI}, Method: %{REQUEST_METHOD}',\
    tag:'attack-rce',\
    tag:'cve-2026-32922'"

# Rule 1000003: Monitor and block JSON payloads containing suspicious scope escalation
SecRule REQUEST_BODY "@rx \"scope\":\s*\[.*(?:operator\.admin|gateway-admin|system\.run)" \
    "id:1000003,\
    phase:2,\
    block,\
    severity:HIGH,\
    msg:'CVE-2026-32922: Blocked JSON payload with elevated scopes',\
    logdata:'Request body contains suspicious scope escalation attempt',\
    tag:'attack-privilege-escalation',\
    tag:'cve-2026-32922'"

# Rule 1000004: Block pairing requests with operator.admin scope
SecRule ARGS "@rx operator\.pairing.*operator\.admin" \
    "id:1000004,\
    phase:2,\
    block,\
    severity:HIGH,\
    msg:'CVE-2026-32922: Blocked pairing request attempting admin scope escalation',\
    logdata:'Pairing parameter: %{MATCHED_VAR}',\
    tag:'attack-privilege-escalation',\
    tag:'cve-2026-32922'"

# Rule 1000005: Rate limit OpenClaw API token endpoints
SecRule REQUEST_URI "@rx /(?:device|token|pairing)" \
    "id:1000005,\
    phase:2,\
    pass,\
    severity:NOTICE,\
    msg:'CVE-2026-32922: OpenClaw API access tracked for rate limiting',\
    setvar:'ip.openclaw_requests=+1',\
    expirevar:'ip.openclaw_requests=300',\
    tag:'monitoring',\
    tag:'cve-2026-32922'"

# Rule 1000006: Block excessive OpenClaw API requests
SecRule IP:OPENCLAW_REQUESTS "@gt 10" \
    "id:1000006,\
    phase:2,\
    block,\
    severity:WARNING,\
    msg:'CVE-2026-32922: Rate limit exceeded for OpenClaw API requests',\
    logdata:'Request count: %{IP.OPENCLAW_REQUESTS}',\
    tag:'attack-dos',\
    tag:'cve-2026-32922'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-32922?¶

CVE-2026-32922 is a Critical (9.9) vulnerability: OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32922?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32922?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.