CVE-2026-41386Disclosure(openclaw / openclaw)

LOWCVSS 9.8 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

Patch openclaw openclaw systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.

openclaw CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9

Vendor / third-party advisories

Weakness type (CWE)

CWE-648

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

Patch or workaround signal is available
6 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked at 4 mentions on most recent observed day (2026-05-12)
6 total mentions across 2 days

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline6 mentions / 2d

Signal classification3 categories

Disclosure

350.0%

General

233.3%

Patch

116.7%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-28	2	Disclosure1Patch1
2026-05-12	4	Disclosure2General2

Full discourse6 posts

Lyrie.ai@lyrie_ai149d
General
https://lyrie.ai/research/research/cve-2026-41386-openclaw-openclaw #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The provided text contains only a URL and hashtags, offering no substantive information about the vulnerability or its exploitation.
0001023
210 followersView on X
Lyrie.ai@lyrie_ai149d
General
References CVE: CVE-2026-41386 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The text lists a critical CVE and its CVSS score but offers no further exploitation or mitigation information.
1000029
210 followersView on X
Lyrie.ai@lyrie_ai149d
Disclosure
CVE: CVE-2026-41386 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles…
Post summary
The advisory announces a critical privilege escalation issue in OpenClaw versions before 2026.3.22, with detailed CVSS information but no PoC, exploit, or patch provided.
1000039
210 followersView on X
Lyrie.ai@lyrie_ai149d
Disclosure
CRITICAL: CVE-2026-41386 (CVSS 9.1) — openclaw openclaw. CVE: CVE-2026-41386 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
This post announces the discovery of CVE‑2026‑41386, assigning it a critical severity and providing its CVSS score and vector details.
1000027
210 followersView on X
Orizon@OrizonCyber163d
Patch
🚨 CVE-2026-41386 — CVSS 9.1/10 █████████░ OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/nrZqanvjvg
Post summary
CVE-2026-41386 is a critical privilege escalation flaw in OpenClaw, for which a patch is already available.
1000051
25 followersView on X
CVE@CVEnew163d
Disclosure
CVE-2026-41386 OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. … https://www.cve.org/CVERecord?id=CVE-2026-41386
Post summary
The post announces a privilege escalation flaw (CVE-2026-41386) in OpenClaw, describing how bootstrap codes can escape intended device roles during pairing, but it does not provide a PoC, exploit, or remediation details.
0000093
57.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-41386

Lyrie.ai[verified]@lyrie_aiGeneral

The provided text contains only a URL and hashtags, offering no substantive information about the vulnerability or its exploitation.

Lyrie.ai[verified]@lyrie_aiGeneral

The text lists a critical CVE and its CVSS score but offers no further exploitation or mitigation information.

Lyrie.ai[verified]@lyrie_aiDisclosure

The advisory announces a critical privilege escalation issue in OpenClaw versions before 2026.3.22, with detailed CVSS information but no PoC, exploit, or patch provided.

Lyrie.ai[verified]@lyrie_aiDisclosure

This post announces the discovery of CVE‑2026‑41386, assigning it a critical severity and providing its CVSS score and vector details.

Orizon[verified]@OrizonCyberPatch

CVE-2026-41386 is a critical privilege escalation flaw in OpenClaw, for which a patch is already available.

CVE@CVEnewDisclosure

The post announces a privilege escalation flaw (CVE-2026-41386) in OpenClaw, describing how bootstrap codes can escape intended device roles during pairing, but it does not provide a PoC, exploit, or remediation details.