CVE-2026-32987 in OpenClaw
Resumen (Inglés)
OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.
Responsable
VulnCheck
Reservar
2026-03-17
Divulgación
2026-03-29
Voces
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidad | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354115 | OpenClaw device-bootstrap.ts autenticación débil | 294 | No está definido | Arreglo oficial | CVE-2026-32987 |