Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42422 Role Bypass Vulnerability in OpenClaw Before 2026.4.8 Device Token Rotation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42422
Post summary
The text announces CVE‑2026‑42422 as a role bypass vulnerability linked to device token rotation before version 2026.4.8, and provides a link to detail the issue.
CVE-2026-42422 OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypas… https://www.cve.org/CVERecord?id=CVE-2026-42422
Post summary
CVE-2026-42422 discloses a role bypass in OpenClaw's device.token.rotate, permitting creation of tokens for unapproved roles. The notice lacks PoC, exploit code, active exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |