N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-63f5-hhc7-cx6p

GHSA-63f5-hhc7-cx6p: OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval

Summary

openclaw versions <= 2026.3.12 allowed bootstrap setup codes to be replayed before approval, which could widen the scopes on a pending device pairing request.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.12
Fixed version: 2026.3.13

Details

The vulnerable path was bootstrap token verification in src/infra/device-bootstrap.ts. In affected releases, a valid bootstrap setup code could be verified more than once before the pairing request was approved. That allowed a second verification attempt to mutate a pending device pairing and request broader scopes, including escalation from a lower operator scope to operator.admin, before an approver finalized the pairing.

This issue is in scope under OpenClaw's trust model because bootstrap setup codes are an authentication primitive for device pairing and the replay changed the privileges granted to the pending device.

Fix

openclaw@2026.3.13 makes bootstrap setup codes single-use. Current code consumes the bootstrap token record on the first successful verification, so replay attempts fail before pending scopes can be widened.

Regression coverage exists in src/infra/device-pairing.test.ts (rejects bootstrap token replay before pending scope escalation can be approved).

Fix Commit(s)

1803d16d5cec970c54b0e1ac46b31b1cbade335c

Thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-63f5-hhc7-cx6p

GHSA-63f5-hhc7-cx6p:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.12	2026.3.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the verifyDeviceBootstrapToken function in src/infra/device-bootstrap.ts. The core of the issue is that bootstrap tokens were not single-use. When a bootstrap token was verified, the system would update the existing token record with any new roles and scopes provided in the verification request, using the mergeRoles and mergeScopes helper functions. This allowed an attacker to make multiple verification requests with the same token, each time adding more permissive scopes, effectively escalating the privileges of a pending device pairing request before it was approved by an administrator. The fix addresses this by removing the logic for merging scopes and roles and instead deleting the token record from the state after the first successful verification. This ensures that each bootstrap token can only be used once, preventing any replay attacks aimed at escalating privileges.

Vulnerable functions

verifyDeviceBootstrapToken

src/infra/device-bootstrap.ts

The `verifyDeviceBootstrapToken` function was vulnerable because it allowed a bootstrap token to be reused. Instead of consuming the token after a single use, it would update the token record with new, potentially escalated, scopes using the `mergeRoles` and `mergeScopes` functions. This allowed an attacker to replay a valid bootstrap code to widen the permissions of a pending device pairing request before it was approved.

mergeRoles

src/infra/device-bootstrap.ts

This function was part of the vulnerable logic. It was used by `verifyDeviceBootstrapToken` to merge new roles into the existing token record, allowing for privilege escalation. The function was removed as part of the fix to make bootstrap tokens single-use.

mergeScopes

src/infra/device-bootstrap.ts

This function was part of the vulnerable logic. It was used by `verifyDeviceBootstrapToken` to merge new scopes into the existing token record, allowing for privilege escalation. The function was removed as part of the fix to make bootstrap tokens single-use.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.