Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat command access can create setup codes to enroll devices with operator/node capabilities, granting persistent credentials until manual removal.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 OpenClaw Authorization Bypass in Device-Pair Plugin, #CVE-2026-32905 (High) -DC-Jul2026-842 https://dailycve.com/openclaw-authorization-bypass-in-device-pair-plugin-cve-2026-32905-high-dc-jul2026-842/
Post summary
The post announces a new high‑severity authorization bypass vulnerability (CVE‑2026‑32905) affecting the OpenClaw Device‑Pair Plugin, focusing on the initial disclosure details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |