OpenClaw versions up to 2026.4.7 have a vulnerability in the device token rotation process that allows minting tokens with unapproved roles, bypassing the intended device role-upgrade pairing. This flaw could lead to unauthorized elevation of device privileges. The issue is fixed in version 2026.4.8.