CVE-2026-32987 - Vulnerability Analysis

Overview

OpenClaw < 2026.3.13 contains a privilege escalation caused by replay of bootstrap setup codes during device pairing verification in src/infra/device-bootstrap.ts, letting attackers escalate pending pairing scopes including operator.admin privileges, exploit requires valid bootstrap code replay.

Severity & Score

Impact

Attackers can escalate privileges to operator.admin by replaying bootstrap codes multiple times before approval.

Mitigation

Update to version 2026.3.13 or later.

References

• https://github.com/openclaw/openclaw/commit/1803d16d5cec970c54b0e1ac46b31b1cbade335c
• https://github.com/openclaw/openclaw/security/advisories/GHSA-63f5-hhc7-cx6p
• https://www.vulncheck.com/advisories/openclaw-bootstrap-setup-code-replay-via-device-pairing

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 29, 2026

🔴 CVE-2026-32987 - Critical (9.8) OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scope... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32987/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner