OpenClaw privilege escalation vulnerability • Hacker News Board

Re: OpenClaw privilege escalation vulnerability

#11

Post by crazy5sheep » Fri, Apr 03, 2026, 5:19 PM UTC

cactusplant7374 wrote: post #5

deadbabe wrote: post #2

Earlier quoted context omitted.

[flagged]

What reason would Steinberger have for doing that? It was his hobby project.

[dead]

Re: OpenClaw privilege escalation vulnerability

#12

Post by rvz » Fri, Apr 03, 2026, 5:20 PM UTC

OpenClaw has over 400+ security issues and vulnerabilities. [0]

Why on earth would you install something like that has access to your entire machine, even if it is a separate one which has the potential to scan local networks?

Who is even making money out of OpenClaw other than the people attempting to host it? I see little use out of it other than a way to get yourself hacked by anyone.

[0] https://github.com/openclaw/openclaw/security

Re: OpenClaw privilege escalation vulnerability

#13

Post by throwatdem12311 » Fri, Apr 03, 2026, 5:20 PM UTC

Think of all the people that are too ignorant to even understand the basics of any of this that are running OpenClaw. They will be completely unaware and attackers can easily hide their tracks by changing system prompts (among plenty of other things).

This is bad.

Re: OpenClaw privilege escalation vulnerability

#14

Post by tgv » Fri, Apr 03, 2026, 5:21 PM UTC

gos9 wrote: post #8

Really? Posting AI generated Reddit post with no sources or anything?

The CVE seems to be real.

Re: OpenClaw privilege escalation vulnerability

#15

Post by Simon321 » Fri, Apr 03, 2026, 5:21 PM UTC

Only if your openclaw instance is publicly exposed on the internet... which is not the case for most people

Re: OpenClaw privilege escalation vulnerability

#16

Post by fraywing » Fri, Apr 03, 2026, 5:21 PM UTC

dang wrote: post #179

[stub for offtopicness and general piling-on behavior, which we don't want on this site] [[attacking project creators when they show up to discuss their work is particularly harmful; please don't ever do that here]] [[[if you posted any of these, we'd appreciate it if you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules from now on]]]

[flagged]

Re: OpenClaw privilege escalation vulnerability

#17

Post by blharr » Fri, Apr 03, 2026, 5:22 PM UTC

[flagged]

Re: OpenClaw privilege escalation vulnerability

#18

Post by asdff » Fri, Apr 03, 2026, 5:22 PM UTC

cactusplant7374 wrote: post #5

deadbabe wrote: post #2

Earlier quoted context omitted.

[flagged]

What reason would Steinberger have for doing that? It was his hobby project.

He doesn't need a reason. He could have been captured by intelligence after the fact.

Re: OpenClaw privilege escalation vulnerability

#19

Post by hmokiguess » Fri, Apr 03, 2026, 5:22 PM UTC

gos9 wrote: post #8

Really? Posting AI generated Reddit post with no sources or anything?

The link mentions the CVE, here's the link https://nvd.nist.gov/vuln/detail/CVE-2026-33579

Re: OpenClaw privilege escalation vulnerability

#20

Post by niwtsol » Fri, Apr 03, 2026, 5:23 PM UTC

Title is a bit misleading, no? You have to have openclaw running on an open box. And the post even says "135k open instances" out of 500k running instances? so a bit clickbait-y