Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuard View on GitHub

GHSA-63f5-hhc7-cx6p

HighCVSS 8.6 / 10

Published Mar 16, 2026·Last modified Mar 16, 2026

Affected Components(0)

No affected components available

Description

Summary

openclaw versions <= 2026.3.12 allowed bootstrap setup codes to be replayed before approval, which could widen the scopes on a pending device pairing request.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.12
Fixed version: 2026.3.13

Details

The vulnerable path was bootstrap token verification in src/infra/device-bootstrap.ts. In affected releases, a valid bootstrap setup code could be verified more than once before the pairing request was approved. That allowed a second verification attempt to mutate a pending device pairing and request broader scopes, including escalation from a lower operator scope to operator.admin, before an approver finalized the pairing.

This issue is in scope under OpenClaw's trust model because bootstrap setup codes are an authentication primitive for device pairing and the replay changed the privileges granted to the pending device.

Fix

openclaw@2026.3.13 makes bootstrap setup codes single-use. Current code consumes the bootstrap token record on the first successful verification, so replay attempts fail before pending scopes can be widened.

Regression coverage exists in src/infra/device-pairing.test.ts (rejects bootstrap token replay before pending scope escalation can be approved).

Fix Commit(s)

1803d16d5cec970c54b0e1ac46b31b1cbade335c

Thanks @tdjackey for reporting.

Risk Scores

Base Score

8.6

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights.

Threat Intelligence

6.2

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS

0.35%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

High severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard