Openclaw cli: OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement (CVE-2026-42432)
Description
CVE-2026-42432 is a vulnerability in the openclaw-cli package where a previously paired node can reconnect and execute commands with elevated privileges, bypassing the operator.admin scope requirement. This allows the node to perform exec-capable commands without requiring operator/admin re-pairing. The issue affects versions up to 2026.4.5 and was fixed in version 2026.4.8.
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in openclaw-cli (CVE-2026-42432) allows a previously paired node to reconnect with an expanded command set, including commands capable of execution, without enforcing the operator/admin re-pairing process. This escalation bypasses the intended operator.admin scope restriction. The flaw affects versions <=2026.4.5 and was addressed in version 2026.4.8 with a fix verified by regression testing.
Potential Impact
An attacker controlling a previously paired node can bypass the operator.admin scope requirement and execute high-privilege commands without re-pairing as an operator or admin. This leads to high confidentiality, integrity, and availability impacts as indicated by the CVSS score of 7.8.
Mitigation Recommendations
A patch is available and should be applied by upgrading openclaw-cli to version 2026.4.8 or later. The fix has been verified with regression tests to ensure the security boundary is enforced. No additional mitigations are specified or required beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-42432
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2459812601ec6a3165d39
Added to database: 10/04/2026, 12:24:56 UTC
Last enriched: 10/04/2026, 12:43:28 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.