Improper access control in OpenClaw - #VU132749
Published: May 29, 2026
Vulnerability identifier: #VU132749
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to retain or restore device scopes broader than intended.
The vulnerability exists due to improper access control in the device re-pairing feature when processing a re-pairing request with an empty scope set. A remote user can send a crafted device re-pairing request to retain or restore device scopes broader than intended.
Only configurations with the affected feature enabled and reachable are vulnerable.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.4.25