Executive brief
OpenClaw is an npm package used for device pairing and setup. During the initial pairing process, bootstrap setup codes were not properly validated to match the intended device role and access permissions, allowing an attacker to escalate privileges from a restricted pairing session to full administrative access without needing existing credentials.
Technical details
The vulnerability is an improper privilege management issue (CWE-269) in OpenClaw's bootstrap setup code validation. Bootstrap codes used during device pairing were not bound to the intended device role and scopes, allowing privilege escalation during the first-use pairing process. This is a local or adjacent attack that occurs at setup time and requires no prior authentication; an attacker performing initial device pairing can bypass role-based access controls. The vulnerability was patched in version 2026.3.22 (commit a600c72ed7d0045a27f58bf031d2b36ecb0141c9), and the fix is available in all released versions 2026.3.22 and later.
Affected products
- OpenClaw openclaw <=2026.3.13-1, patched in >=2026.3.22
Timeline
- 2026-03-31: disclosed
- 2026-03-22: patched: Fix released in v2026.3.22