https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:31:35 +0000 https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-32987 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary `openclaw` versions `&lt;= 2026.3.12` allowed bootstrap setup codes to be replayed before approval, which could widen the scopes on a pending device pairing request.</p> <p>### Affected Packages / Versions - Package: `openclaw` (`npm`) - Affected versions: `&lt;= 2026.3.12` - Fixed version: `2026.3.13`</p> <p>### Details The vulnerable path was bootstrap token verification in `src/infra/device-bootstrap.ts`. In affected releases, a valid bootstrap setup code could be verified more than once before the pairing request was approved. That allowed a second verification attempt to mutate a pending device pairing and request broader scopes, including escalation from a lower operator scope to `operator.admin`, before an approver finalized the pairing.</p> <p>This issue is in scope under OpenClaw&#39;s trust model because bootstrap setup codes are an authentication primitive for device pairing and the replay changed the privileges granted to the pending device.</p> <p>### Fix `openclaw@2026.3.13` makes bootstrap setup codes single-use. Current code consumes the bootstrap token record on the first successful verification, so replay attempts fail before pending scopes can be widened.</p> <p>Regression coverage exists in `src/infra/device-pairing.test.ts` (`rejects bootstrap token replay before pending scope escalation can be approved`).</p> <p>### Fix Commit(s) - `1803d16d5cec970c54b0e1ac46b31b1cbade335c`</p> <p>Thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary `openclaw` versions `&lt;= 2026.3.12` allowed bootstrap setup codes to be replayed before approval, which could widen the scopes on a pending device pairing request.</p> <p>### Affected Packages / Versions - Package: `openclaw` (`npm`) - Affected versions: `&lt;= 2026.3.12` - Fixed version: `2026.3.13`</p> <p>### Details The vulnerable path was bootstrap token verification in `src/infra/device-bootstrap.ts`. In affected releases, a valid bootstrap setup code could be verified more than once before the pairing request was approved. That allowed a second verification attempt to mutate a pending device pairing and request broader scopes, including escalation from a lower operator scope to `operator.admin`, before an approver finalized the pairing.</p> <p>This issue is in scope under OpenClaw&#39;s trust model because bootstrap setup codes are an authentication primitive for device pairing and the replay changed the privileges granted to the pending device.</p> <p>### Fix `openclaw@2026.3.13` makes bootstrap setup codes single-use. Current code consumes the bootstrap token record on the first successful verification, so replay attempts fail before pending scopes can be widened.</p> <p>Regression coverage exists in `src/infra/device-pairing.test.ts` (`rejects bootstrap token replay before pending scope escalation can be approved`).</p> <p>### Fix Commit(s) - `1803d16d5cec970c54b0e1ac46b31b1cbade335c`</p> <p>Thanks @tdjackey for reporting.</p> https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-32987