CVE-2026-32987: Openclaw

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.

Affected products

• Openclaw Openclaw: before 2026.3.13 (fixed in 2026.3.13)

Published 2026-03-29. Last modified 2026-06-17.