CVE-2026-32987
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Mar 29, 2026
Vendor
unknown
Description
OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.