PT-2026-35771 · Openclaw · Openclaw

Tdjackey · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41386

Mitre

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.

Fix

LPE

Weakness Enumeration

CWE-648

Related Identifiers

CVE-2026-41386

Affected Products

Openclaw

References · 6

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41386 · Security Note
• https://twitter.com/OrizonCyber/status/2049239763656315266 · Twitter Post
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes · Note
• https://twitter.com/CVEnew/status/2049227534147973615 · Twitter Post