Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-32987
9.8 CRITICAL
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing
OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.
References
-
GitHub Security Advisory (GHSA-63f5-hhc7-cx6p) third-party-advisory
-
Patch Commit patch
Affected products
OpenClaw
- ==2026.3.13
- <2026.3.13
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>