OpenClaw versions prior to 2026.3.22 contain a vulnerability where bootstrap setup codes are not properly bound to the intended device roles and scopes. This flaw allows an attacker to escalate privileges during the initial pairing process. The issue has been fixed in version 2026.3.22 and later.