Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-32987 is a critical-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Openclaw Openclaw. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32987 is a vulnerability in OpenClaw versions prior to 2026.3.13 that allows replay attacks on bootstrap setup codes during device pairing verification. The issue resides in the src/infra/device-bootstrap.ts component, where valid bootstrap codes can be reused multiple times before approval, enabling escalation of pending pairing scopes. This flaw, classified under CWE-294 (Authentication Bypass by Capture-replay), carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact confidentiality, integrity, and availability effects.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. By capturing and replaying a legitimate bootstrap setup code during the pairing process, adversaries can verify it repeatedly, bypassing intended one-time-use protections. Successful exploitation allows escalation of pairing scopes, including privilege escalation to the operator.admin role, potentially granting unauthorized administrative control over affected devices.
Mitigation is addressed in OpenClaw version 2026.3.13 and later, as detailed in the project's GitHub security advisory (GHSA-63f5-hhc7-cx6p) and the fixing commit (1803d16d5cec970c54b0e1ac46b31b1cbade335c). Security practitioners should upgrade to the patched version immediately and review the VulnCheck advisory for additional details on detection and remediation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17022
Vulnerability Data
OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.16V10.5.1
Mitigating Controls (NIST 800-53 r5) AI
Session authenticity mechanisms directly stop replay of captured authentication traffic by enforcing freshness or cryptographic binding.
Transmission integrity (with anti-replay) stops captured messages from being accepted as valid later.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic protections (e.g., nonces, timestamps, message authentication codes) make captured authentication messages unusable for replay.
Secure authentication mechanisms directly prevent replay attacks by requiring fresh, non-replayable credentials or tokens.
Network security controls such as encryption and integrity protection reduce the feasibility of capturing and replaying authentication traffic.
Application security requirements can mandate replay-resistant authentication designs, but the control itself does not prescribe the technical measures.