PT-2026-35810 · Openclaw · Openclaw

Keensecuritylab · Published 2026-04-09 · Updated 2026-04-28 · CVE-2026-42432

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description A privilege escalation issue allows previously paired nodes to reconnect and send exec-capable commands without requiring the operator.admin scope. This enables attackers to bypass re-pairing authentication and execute privileged commands on the local assistant system.

Recommendations Update to version 2026.4.8 or later.

Fix

LPE

Incorrect Authorization

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-863

CWE-288

Related Identifiers

CVE-2026-42432

GHSA-5WJ5-87VQ-39XM

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5wj5-87vq-39xm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5wj5-87vq-39xm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42432 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2049227491986817062 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049265622626742647 · Twitter Post
• https://vulncheck.com/advisories/openclaw-command-escalation-via-node-pairing-reconnect-bypass · Note