OpenClaw EUVD-2026-37164

The attacker must already hold a valid pending bootstrap token, meaning they must have completed the initial pairing-request step with the target OpenClaw instance - fully external unauthenticated attackers without a pending token cannot exploit this flaw. Exploitation must occur within the specific time window between token issuance and the moment an administrator approves or rejects the pending pairing request (reflected in CVSS 4.0 AC:H and AT:P). The CVSS 4.0 UI:P (passive user interaction) indicates that an administrator must have triggered or be actively processing the approval workflow during the attack window. Non-default or high-value scope configurations amplify the impact but are not a prerequisite for exploitation. Factors that limit exploitation: the narrow and unpredictable approval timing window, the need for the attacker to have an existing pending token relationship with the target system, and the low CVSS impact ceiling (low confidentiality, low integrity).

The CVSS 4.0 score of 2.3 accurately reflects a low-risk vulnerability. The vector (AV:N/AC:H/AT:P/PR:N/UI:P) surfaces three significant dampeners: high attack complexity, a required attack target precondition (AT:P - the pending token must exist and sit in an open approval queue), and passive user interaction (an approval workflow must be in motion). Impact is bounded to low confidentiality and low integrity effects on the vulnerable system only, with no availability or subsequent-system consequences. No EPSS score was provided in the source intelligence; however, the combination of narrow exploitation window, specific preconditions, and limited blast radius suggests low opportunistic exploitation probability. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified. This is a real but low-severity logical flaw: a realistic concern for organizations where bootstrap pairing is used to grant high-value downstream access, but not an urgent remediation priority for most deployments.

An attacker who has legitimately initiated a pairing request with an OpenClaw instance obtains a pending bootstrap token and, before an administrator approves or rejects it, replays that token against the API with a crafted request specifying a broader set of scopes than originally submitted. If the server processes the replayed request within the open approval window without re-validating the originally bound scope, the attacker's pairing authority is elevated beyond the intended limit. No public proof-of-concept exists, and the tight timing dependency and required target precondition make opportunistic exploitation unlikely.