CVE-2026-42422
OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval.
Ver en NVDAnálisis
OpenClaw appears to be a niche device management or utility project rather than a widely used piece of infrastructure or dev tooling. While the auth bypass is severe for its users, it does not meet the threshold for general community interest in the MexicoDev stack.
Severidad
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCWE-863EPSS
Afecta
openclaw:openclawDescripción técnica
OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval.