OpenClaw CVE-2026-32922 exposes token rotation scope failure

At a glance

What this is: This is a disclosure of CVE-2026-32922 in OpenClaw, where token rotation can elevate a low-privilege pairing token into full administrative access and then remote code execution.

Why it matters: It matters because self-hosted AI assistant gateways are becoming non-human identity control planes, and a single scope-validation flaw can turn shadow IT into an enterprise-wide blast radius.

By the numbers:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems.

👉 Read ARMO's analysis of CVE-2026-32922 in OpenClaw

Context

OpenClaw is a personal AI assistant platform, but in practice it behaves like a non-human identity gateway because it mints, rotates, and scopes tokens for connected clients and downstream actions. CVE-2026-32922 shows what happens when a token lifecycle control fails to constrain privilege escalation inside that gateway, especially when the product is self-hosted in cloud or Kubernetes environments.

The primary governance gap is not just exposure, but scope integrity. If a system can rotate credentials and expand privilege beyond the caller’s own permissions, then least privilege is only being checked at the wrong moment. That is the same failure pattern identity teams see in service accounts, API tokens, and agent-facing control planes when lifecycle enforcement and authorisation are decoupled.

ARMO’s analysis also makes clear that many instances are being run with weak or absent authentication, which turns a logic bug into a high-confidence enterprise risk. For cloud security teams, the relevant question is not whether the tool is marketed as personal, but whether it sits on a production network path with credentials, approvals, or execution rights.

Key questions

Q: What breaks when a token rotation endpoint can mint broader scopes than the caller already has?

A: Least privilege breaks first, because renewal becomes privilege expansion. That turns a narrow pairing or service token into an administrative credential without a separate authorisation decision. In practice, the system can then perform legitimate-looking actions that conceal compromise, which is why scope intersection must be enforced at issuance time.

Q: Why do self-hosted AI assistant gateways increase identity risk in cloud environments?

A: They combine credential storage, token issuance, and execution reach in one place. If the gateway can access model APIs, messaging platforms, or internal nodes, then a token flaw becomes a multi-system blast radius. That is why these tools should be governed as production non-human identities, not as personal utilities.

Q: How should security teams reduce risk from overprivileged non-human identities?

A: Start by identifying every non-human identity and the exact permissions it uses in production. Then remove broad access, separate duties across workloads, and require periodic entitlement review. The goal is not just fewer identities, but smaller blast radius when one credential is exposed or misused.

Q: Who is accountable when an AI assistant platform escalates access through a token bug?

A: Accountability sits with the organisation operating the platform, because it chose where the gateway runs, what it can reach, and how its token lifecycle is governed. If the system is self-hosted in corporate infrastructure, the ownership burden is the same as for any privileged automation or service account.

Technical breakdown

Why token rotation becomes a privilege boundary

Token rotation is supposed to reissue credentials without widening what the caller can do. In OpenClaw, the rotation path accepts requested scopes and fails to verify that they are a subset of the caller’s existing scope set. That means the control is operating as a minting function, not a constrained renewal function. In identity terms, the system loses the distinction between possession of a narrow token and authority to ask for broader privilege. This is a classic lifecycle enforcement failure, because the security decision happens after the request is already treated as trusted.

Practical implication: validate scope inheritance at rotation time, not after token issuance.

How a paired-device token becomes an admin path

The attack depends on a low-privilege operator.pairing token reaching the device.token.rotate endpoint and requesting operator.admin in the new scope set. Because the gateway does not intersect requested scopes with the caller’s allowed scopes, the result is a fully privileged token that can invoke system.run and other administrative functions. This is not cryptographic breakage. It is incorrect privilege assignment in a token lifecycle workflow. Once that token exists, the gateway can perform legitimate-looking actions that mask attacker control.

Practical implication: treat pairing tokens as high-risk NHI credentials and constrain what they can ever mint.

Why the blast radius extends beyond the gateway

OpenClaw often sits in environments where it can reach messaging tokens, AI provider keys, internal services, and Kubernetes workloads. When operator.admin is granted, the gateway can execute commands on connected nodes, install extensions, and alter approval settings. That turns a token flaw into lateral movement across the infrastructure the gateway touches. The important architectural point is that assistant platforms are not isolated tools once they are granted network reach and stored secrets. They become control planes for other identities and workloads.

Practical implication: map every downstream system reachable from the gateway before treating its tokens as low sensitivity.

Threat narrative

Attacker objective: The attacker’s objective is full administrative control of the OpenClaw gateway and the connected infrastructure it can reach.

1. Entry occurs when an attacker obtains or abuses a low-privilege operator.pairing token through legitimate device pairing or compromise of an existing paired device.
2. Escalation occurs when the attacker calls device.token.rotate and requests operator.admin scopes, which the gateway fails to constrain to the caller’s original scope set.
3. Impact occurs when the attacker uses the elevated token to invoke system.run, reconfigure approvals, and pivot into connected nodes and stored secrets.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Gladinet Hard-Coded Keys RCE Exploitation — Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Token rotation without scope intersection is a governance failure, not a niche implementation bug. The control should preserve the caller’s existing authority, yet OpenClaw’s rotation path can mint a broader token than the one presented. That breaks the core assumption behind least privilege, which is that renewal preserves or narrows authority rather than expands it. Practitioners should read this as a lifecycle enforcement problem, not simply a code defect.

Self-hosted AI assistant gateways are becoming NHI control planes with human blind spots. OpenClaw is described as a personal tool, but once it connects to messaging apps, models, and infrastructure, it behaves like a privileged identity broker. That places it squarely in the NHI governance domain because it can authenticate, rotate, and execute on behalf of downstream systems. Cloud teams need to classify these gateways as production identities, not convenience tooling.

Least privilege stops being meaningful if token minting is divorced from token authority. In this case, the system can issue operator.admin based on a request, not on the caller’s prior rights. That is the specific broken premise: a credential issuer should never be able to expand privilege beyond the subject that is asking for renewal. The implication is that token lifecycle reviews must cover issuance logic, not just stored secrets.

OpenClaw shows how shadow AI becomes security-relevant the moment it touches networked execution. A developer tool can look harmless until it is allowed to reach APIs, nodes, and credentials. At that point, the platform is no longer an endpoint curiosity, it is an identity boundary with production blast radius. Practitioners should govern these systems with the same seriousness they apply to service accounts and privileged automation.

Scope validation is the real control surface in modern non-human identity systems. Cryptography, pairing, and token formats can all be intact while the authorization layer silently over-issues access. That means security teams need to evaluate not only whether tokens are signed, but whether every mint, rotate, and refresh action is constrained by the caller’s original authority. The practical lesson is to audit the issuing path, not just the stored credential.

From our research:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to The 2026 Infrastructure Identity Survey.
• If your programme still treats assistant gateways as convenience tools, the Ultimate Guide to NHIs , Key Challenges and Risks shows why scope sprawl and unmanaged credentials become control failures.

What this signals

Shadow AI becomes an identity problem the moment it mints credentials. Self-hosted assistants, gateway services, and automation wrappers are not merely software assets. Once they can issue or rotate tokens, they need governance on par with other non-human identities. The reader should expect more of these systems to sit outside standard IAM review cycles unless discovery is tied to infrastructure scanning and token telemetry.

Scope integrity is the new control boundary for assistant platforms. The old assumption that a credential refresh preserves the original privilege model no longer holds across many AI-adjacent control planes. That is why the identity blast radius of these systems is so hard to see in dashboards alone, and why lifecycle governance has to inspect issuance logic as well as stored secrets.

With only 44% of organisations having policies to manage AI agents, per the 2026 Infrastructure Identity Survey, most enterprises are still behind the curve on basic governance. The practical signal is that privileged assistant workflows will keep appearing before review models are ready to evaluate them.

For practitioners

• Inventory all OpenClaw instances as production identities Search Kubernetes clusters, developer laptops, cloud VMs, and self-hosted gateways for any OpenClaw deployment. Treat each instance as an identity control plane if it can reach messaging tokens, model APIs, or internal services. If you cannot explain its network reach, it is already part of the attack surface.
• Block token rotation from widening caller scope Review the device.token.rotate path and enforce intersection between the requested scopes and the caller’s current scope set. If the caller holds operator.pairing, it should never be able to mint operator.admin or any other broader privilege.
• Remove pairing as an always-on entry point Revoke all operator.pairing tokens where possible, disable the pairing endpoint when new device onboarding is not required, and bind the gateway to localhost or equivalent restricted network exposure. This cuts off the easiest privilege escalation path.
• Audit downstream command execution and secrets access Check logs for system.run, config.patch, sessions.delete, and unexpected skill installation activity originating from device identities. Then rotate all API keys, messaging tokens, and environment secrets that the gateway could access.

Key takeaways

• CVE-2026-32922 is a token lifecycle failure that turns a narrow pairing credential into administrative control and then remote execution.
• The exposure matters because self-hosted AI assistant gateways can sit on production paths with messaging tokens, API keys, and internal network reach.
• The control that would have reduced the risk is scope intersection at mint time, plus tighter network exposure and removal of always-on pairing access.

Key terms

• Token Rotation Scope Validation: The check that ensures a refreshed or reissued token cannot request more privilege than the token or identity already has. In non-human identity systems, this control must be enforced at mint time, because any gap can let a narrow credential become a broad administrative one.
• Scope Intersection: The process of limiting a requested privilege set to the overlap between what the caller asks for and what the caller is already allowed to hold. For AI assistant gateways and service identities, it is a core safeguard against privilege expansion during rotation or refresh workflows.
• Shadow AI Gateway: An AI assistant, control plane, or wrapper service that is running outside formal security governance but can still access credentials, APIs, or infrastructure. These systems often look like productivity tools until they become identity brokers with real production blast radius.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full analysis

ARMO's full blog covers the operational detail this post intentionally leaves for the source:

• Exact vulnerable code path and line-level analysis in openclaw/src/infra/device-pairing.ts
• Step-by-step reproduction flow showing how operator.pairing becomes operator.admin
• Specific detection logic for device.token.rotate abuse and related gateway logs
• Patch and hardening guidance for Kubernetes, firewall, and local-only deployment settings

👉 ARMO's full post covers the exploit path, exposure scope, and remediation steps

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.