{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-42429/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-42429"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenClaw"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","webserver","CVE-2026-42429"],"_cs_type":"advisory","_cs_vendors":["OpenClaw"],"content_html":"\u003cp\u003eOpenClaw, in versions prior to 2026.4.8, is susceptible to a privilege escalation vulnerability within its gateway plugin's HTTP authentication mechanism. This flaw allows an attacker to elevate their permissions from \u003ccode\u003eoperator.read\u003c/code\u003e to \u003ccode\u003eoperator.write\u003c/code\u003e, effectively granting them unauthorized control over runtime operations. The vulnerability stems from the gateway plugin improperly handling identity-bearing requests. By exploiting this, malicious actors can leverage the gateway's authentication route to escalate privileges and perform actions beyond their intended scope. This poses a significant risk to the integrity and security of OpenClaw deployments, potentially leading to unauthorized modifications, data breaches, or service disruptions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies an OpenClaw instance running a version prior to 2026.4.8 with the gateway plugin enabled.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP request with read-only permissions (\u003ccode\u003eoperator.read\u003c/code\u003e) targeting the gateway authentication route.\u003c/li\u003e\n\u003cli\u003eThe gateway plugin incorrectly processes the request, widening the permission scope to include \u003ccode\u003eoperator.write\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully authenticates through the gateway with the escalated privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the gained \u003ccode\u003eoperator.write\u003c/code\u003e permissions to perform unauthorized runtime operations.\u003c/li\u003e\n\u003cli\u003eThese operations could include modifying system configurations or accessing sensitive data.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains the escalated privileges for further malicious activity.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to bypass intended access controls and gain elevated privileges within the OpenClaw system. This can lead to unauthorized modification of critical system settings, potentially disrupting services or compromising sensitive data. While the specific number of affected installations is unknown, any OpenClaw deployment running a version before 2026.4.8 with the gateway plugin enabled is potentially vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenClaw to version 2026.4.8 or later to patch the vulnerability (CVE-2026-42429).\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious requests targeting the gateway authentication route that may indicate exploitation attempts. Deploy the Sigma rule provided below to detect potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eReview and enforce strict access control policies within OpenClaw to minimize the potential impact of privilege escalation attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-29T12:00:00Z","date_published":"2026-04-29T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-29-openclaw-privesc/","summary":"OpenClaw before 2026.4.8 contains a privilege escalation vulnerability where attackers can gain unauthorized write access to runtime operations by sending read-scoped requests through the gateway authentication route.","title":"OpenClaw Gateway Plugin HTTP Authentication Privilege Escalation","url":"https://feed.craftedsignal.io/briefs/2026-04-29-openclaw-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - CVE-2026-42429","version":"https://jsonfeed.org/version/1.1"}