CVE-2026-32987 Details
Description
OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.
A vulnerability in OpenClaw versions prior to 2026.3.13 allows for the replay of bootstrap setup codes during the device pairing verification process. This issue is present in the file 'src/infra/device-bootstrap.ts'. The vulnerability arises because a valid bootstrap code can be verified multiple times before the pairing request is approved. Exploiting this flaw enables attackers to escalate pending pairing scopes, including privileges, such as gaining 'operator.admin' rights.
Users can upgrade to OpenClaw version 2026.3.13 or later, which addresses this vulnerability by making bootstrap setup codes single-use. Instructions for updating can be found in the OpenClaw documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.3.13 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 29, 2026 | New CVE Received | [email protected] |