PT-2026-35801 · Openclaw · Openclaw

Nicky · Published 2026-04-09 · Updated 2026-04-29 · CVE-2026-42422

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description A role bypass issue exists in the device.token.rotate() function. This flaw allows attackers to bypass device role-upgrade pairing, enabling the minting of tokens for unapproved roles and the preservation of roles and scopes that did not undergo the intended approval process.

Recommendations Update to version 2026.4.8 or later. As a temporary workaround, restrict access to the device.token.rotate() function until the update is applied.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42422

GHSA-WHF9-3HCX-GQ54

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-whf9-3hcx-gq54 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42422 · Security Note
• https://osv.dev/vulnerability/GHSA-whf9-3hcx-gq54 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-role-bypass-in-device-token-rotate-function · Note
• https://twitter.com/VulmonFeeds/status/2049296339423433064 · Twitter Post
• https://twitter.com/CVEnew/status/2049227501335965937 · Twitter Post