CVE-2026-42422
Role Bypass Vulnerability in OpenClaw Device Token Rotation
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.4.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2026-42422 affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-42422 is a role bypass vulnerability in the OpenClaw package versions before 2026.4.8. It occurs in the device.token.rotate function, which improperly allows minting tokens for roles that have not been approved through the intended device role-upgrade pairing process.
This flaw lets attackers bypass the authorization mechanism designed to control role upgrades, enabling them to create or maintain roles and scopes without the necessary approval.
The vulnerability corresponds to CWE-863 (Incorrect Authorization), meaning the product performs authorization checks but fails to do so correctly, allowing unauthorized access or actions.
How can this vulnerability impact me? :
This vulnerability can have a high impact because it allows attackers to bypass role upgrade controls and mint tokens for unapproved roles.
As a result, attackers can preserve or create roles and scopes without intended approval, potentially gaining unauthorized access or privileges within the OpenClaw environment.
The CVSS v4.0 base score of 7.7 and v3.1 base score of 8.8 reflect high severity, indicating significant impacts on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-42422 vulnerability, you should upgrade the OpenClaw package to version 2026.4.8 or later, where the issue in the device.token.rotate function has been fixed.
This update ensures that the authorization checks for role upgrades are properly enforced, preventing unauthorized minting of tokens for unapproved roles.