Authorization Bypass in OpenClaw Device-Pair Plugin

CVE-2026-32905

What is CVE-2026-32905?

OpenClaw versions prior to 2026.5.4 contain a vulnerability that allows unauthorized users to bypass authorization checks when issuing device-pairing bootstrap codes. This weakness exists within the bundled device-pair plugin, where attackers with chat command access can exploit the system to create setup codes for enrolling devices with operator or node capabilities. Consequently, this grants persistent access rights until the credentials are manually removed, posing significant security risks.

References