Which versions of OpenClaw are affected by CVE-2026-32905?

CVE-2026-32905 is an authorization bypass in OpenClaw that enables authenticated employees with low-privilege chat access to enroll arbitrary devices with elevated operator or node capabilities.. A patch is available.

How to fix or mitigate CVE-2026-32905?

24 hours: Restrict device-pairing plugin access to authorized administrators only; audit device enrollment logs for unauthorized device registrations with elevated capabilities. 7 days: Implement network segmentation for device-pairing operations; enable comprehensive audit logging for all bootstrap code generation and device enrollment events. 30 days: Monitor vendor security advisories for CVE-2026-32905 patch release; schedule immediate deployment of OpenClaw 2026.5.4 or later when available.

OpenClaw CVE-2026-32905

Q: What is the CVSS score of CVE-2026-32905?

CVE-2026-32905 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33332 HIGH

Missing Authorization (CWE-862)

2026-05-29 disclosure@vulncheck.com

GHSA-jj27-4rc8-m6mm

Authentication Bypass Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 29, 2026 - 17:02 EUVD

Analysis Generated

May 29, 2026 - 16:46 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat command access can create setup codes to enroll devices with operator/node capabilities, granting persistent credentials until manual removal.

AnalysisAI

Authorization bypass in OpenClaw versions before 2026.5.4 allows authenticated chat command users who are not device owners to issue device-pairing bootstrap codes through the bundled device-pair plugin. Exploitation enables an attacker with low-privilege chat access to enroll arbitrary devices with operator or node capabilities, establishing persistent credentials that survive until manual revocation. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

OpenClaw is an open-source platform that exposes a chat-driven command interface and a device-pair plugin responsible for generating bootstrap codes used to enroll new devices into the system with operator or node roles. The root cause is classified as CWE-862 (Missing Authorization): the device-pair plugin accepts pairing-code issuance requests from any authorized chat sender without validating whether the sender holds ownership scope over the target device or operator role. Because the bootstrap codes mint long-lived credentials tied to operator/node capabilities, the missing scope check effectively converts ordinary chat permissions into a privilege-escalation primitive that persists across sessions until an administrator manually removes the enrolled device.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.4 or later, which adds the missing scope validation in the device-pair plugin as described in the GHSA-xr4f-mjxj-w6w5 advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-xr4f-mjxj-w6w5) and the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-unauthorized-device-pairing-bootstrap-code-issuance-via-chat-command). If immediate patching is not possible, disable or unload the bundled device-pair plugin so bootstrap-code issuance is unavailable via chat - accepting the trade-off that legitimate device enrollment will need to be handled out-of-band - and tightly restrict who holds chat command permissions to a minimal set of trusted operators. As an interim detective control, audit the inventory of enrolled devices and operator/node credentials and revoke any pairings whose provenance cannot be tied to an authorized owner, since pre-patch issuances persist until manually removed.