CVE-2026-32905
CVE-2026-32905 · OpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat command access can create setup codes to enroll devices with operator/node capabilities, granting persistent credentials until manual removal.
CVSS 8.7 · Élevée · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node