CVE-2026-42422

OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function

Published Apr 28, 2026 CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Description

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval.

Analysis

Technical impact

OpenClaw versions prior to 2026.4.8 contain a role bypass flaw in the device.token.rotate function that lets an attacker mint or preserve tokens for roles that have not been approved, thereby granting elevated privileges. This weakness is an imprecise authorization check (CWE-863) that can compromise role integrity and potentially give attackers broad access to protected scopes.

Affected Systems

All OpenClaw deployments running any version earlier than 2026.4.8 on a Node.js platform are vulnerable; administrators and users interacting with the device.token.rotate API are at risk. The vulnerability impacts the OpenClaw application itself, which may be deployed in various device management environments.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity flaw. EPSS data is not available, but the lack of a KEV listing suggests no known active exploitation at the time of this analysis. The likely attack vector involves an authenticated user submitting requests to the token rotation endpoint, exploiting the missing approval check; therefore the flaw is exploitable in realistic operational contexts where such endpoints are exposed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenClaw

unaffected

Version	Status	Constraints
`0`	affected	< 2026.4.8
`2026.4.8`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Openclaw

Version	Status	Scheme	Platform
`[0,2026.4.8)`	affected	semver	—
`2026.4.8`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OpenClaw to version 2026.4.8 or later to apply the vendor patch that fixes the token rotation logic.
Re‑configure the device.token.rotate endpoint to enforce role‑approval checks before minting tokens, ensuring that only approved roles can be granted.
Review and monitor audit logs for any unexpected token creation events that could indicate attempted bypass attempts.
Conduct a security review of role assignment workflows to verify that no other endpoints suffer similar authorization gaps.

Generated by OpenCVE AI on April 28, 2026 at 22:55 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-whf9-3hcx-gq54	OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.282% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5
https://github.com/openclaw/openclaw/security/advisories/GHSA-whf9-3hcx-gq54
https://www.vulncheck.com/advisories/openclaw-role-bypass-in-device-token-rotate-function

History

Apr 29, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 28, 2026 7:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval.
Title		OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function
First Time appeared		Openclaw Openclaw openclaw
Weaknesses		CWE-863
CPEs		cpe:2.3:a:openclaw:openclaw::::::node.js::*
Vendors & Products		Openclaw Openclaw openclaw
References		https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 https://github.com/openclaw/openclaw/security/advisories/GHSA-whf9-3hcx-gq54 https://www.vulncheck.com/advisories/openclaw-role-bypass-in-device-token-rotate-function
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`