CVE-2026-42422: Openclaw

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval.

Affected products

• Openclaw Openclaw: before 2026.4.8 (fixed in 2026.4.8)

Published 2026-04-28. Last modified 2026-06-17.