CVE-2026-41386 - OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes

Back Back to CVE browser

CRITICAL

OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes

Published Apr 28, 2026

9.1

CRITICAL

CVSS 4.0

EPSS 0.57%

Description

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.

Affected products

Vendor OpenClaw Product OpenClaw Default
unaffected
Affected
- ≥ 0, < 2026.3.22
Unaffected
- 2026.3.22

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
OpenClaw	OpenClaw	unaffected	Affected ≥ 0, < 2026.3.22 Unaffected 2026.3.22

Ecosystem	Package	Introduced	Fixed
npm	openclaw	0	2026.3.22

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-269

Improper Privilege Management

CWE-648

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26095
Advisory
https://github.com/advisories/GHSA-gg9v-mgcp-v6m7
Advisory
https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9
patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41386
https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26095		Advisory
https://github.com/advisories/GHSA-gg9v-mgcp-v6m7		Advisory
https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9		patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41386
https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes		third-party-advisoryThird Party Advisory