PT-2026-44891 · Openclaw · Device-Pair Plugin+1

Dikai Zou · CVE-2026-32905 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.4

Description An authorization bypass exists in the bundled device-pair plugin. This issue allows non-owner authorized chat senders to issue device-pairing bootstrap codes because the system fails to perform proper scope validation. Attackers with chat command access can generate setup codes to enroll devices with operator or node capabilities, which provides them with persistent credentials until the devices are manually removed.

Recommendations Update to version 2026.5.4 or later.

Exploit

Fix

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-863

Related Identifiers

CVE-2026-32905

GHSA-XR4F-MJXJ-W6W5

Affected Products

Openclaw

Device-Pair Plugin

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32905.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-xr4f-mjxj-w6w5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32905 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32905 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xr4f-mjxj-w6w5 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/dailycve/status/2072748370095972687 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unauthorized-device-pairing-bootstrap-code-issuance-via-chat-command · Note
• https://t.me/cveNotify/209133 · Telegram Post