CVE-2026-41386
Published: 28 April 2026
Summary
CVE-2026-41386 is a critical-severity Incorrect Use of Privileged APIs (CWE-648) vulnerability in Openclaw Openclaw. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 24.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-41386 is a privilege escalation vulnerability in OpenClaw versions before 2026.3.22, where bootstrap setup codes are not bound to the intended device roles and scopes during pairing. This flaw, mapped to CWE-648, carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts from a network-accessible attack with low complexity and no prerequisites.
Attackers can exploit this vulnerability during the first-use device pairing process without requiring privileges or user interaction. Exploitation allows escalation of privileges beyond the attacker's intended role and scope, potentially granting unauthorized access to sensitive functions or data on the affected device.
Mitigation is addressed in OpenClaw 2026.3.22. Patch details are available in the fixing commit at https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9, the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7, and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26095
Vulnerability details
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a network-accessible privilege escalation vulnerability in the device pairing process (no auth or interaction required), directly enabling T1068 (Exploitation for Privilege Escalation) and T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Employs least privilege principle to restrict device operations to intended roles and scopes during pairing, directly preventing privilege escalation.
Enforces approved authorizations for access during bootstrap pairing, ensuring setup codes are bound to specific device roles and scopes.
Requires identification and authentication of devices prior to pairing, helping to validate and bind bootstrap setup codes to intended roles.