CVE-2026-41386 - Vulnerability Analysis

Overview

OpenClaw < 2026.3.22 contains a privilege escalation caused by unbound bootstrap setup codes to device roles and scopes during pairing, letting attackers escalate privileges during first-use device pairing, exploit requires first-use device pairing.

Severity & Score

Impact

Attackers can escalate privileges beyond intended roles during device pairing, potentially gaining unauthorized access or control.

Mitigation

Update to version 2026.3.22 or later.

References

• https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9
• https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 28, 2026

🔴 CVE-2026-41386 - Critical (9.1) OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41386/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner