CVE-2026-32905

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.4

Description An authorization bypass exists in the bundled device-pair plugin. This issue allows non-owner authorized chat senders to issue device-pairing bootstrap codes because the system fails to perform proper scope validation. Attackers with chat command access can generate setup codes to enroll devices with operator or node capabilities, which provides them with persistent credentials until the devices are manually removed.

Recommendations Update to version 2026.5.4 or later.