CVE-2026-32987: OpenClaw bootstrap code replay

CISO Take

OpenClaw before 2026.3.13 contains an authentication replay vulnerability (CWE-294) in its device bootstrap pairing process that allows any unauthenticated network attacker to submit a captured setup code multiple times before approval, incrementally escalating pairing scope until operator.admin access is granted. The CVSS 9.8 profile is worst-case: network-accessible with zero privileges required, no user interaction, and full C/I/A impact, making this trivially weaponizable against any exposed OpenClaw deployment. Although EPSS sits at 0.35% with no public exploit or KEV listing yet, this package carries a documented history of active abuse — AIID #1368 records malicious OpenClaw skills delivering credential stealers via ClawHub — and 396 prior CVEs signal systemic security debt in a platform that manages privileged agent operations. Upgrade to 2026.3.13 immediately; if patching is blocked, restrict bootstrap pairing endpoints to trusted network segments and alert on duplicate code verification attempts against the same pairing session.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Critical risk. The exploitation profile requires no authentication, no special tooling, and no prior access — any network-reachable OpenClaw instance is exposed. Operator.admin is the highest privilege tier in the platform, granting unrestricted control over agent behavior, configurations, and all downstream integrations. The 396 prior CVEs in the package and active AIID linkage to credential theft via the same platform elevate systemic risk well beyond this individual CVE. EPSS at the 73rd percentile with no observed in-the-wild exploitation suggests a race-to-patch window that remains open but is narrowing, particularly for internet-exposed deployments.

How does the attack unfold?

Initial Access

Attacker identifies an internet-exposed OpenClaw device pairing bootstrap endpoint and confirms it is reachable without authentication.

AML.T0049

Token Capture

Attacker obtains a valid bootstrap setup code through network interception, a leaked provisioning document, or observation of a legitimate device pairing workflow.

AML.T0091.000

Replay Escalation

Attacker submits the captured bootstrap code to the verification API repeatedly before approval completes, incrementally escalating pending pairing scopes until operator.admin is reached.

AML.T0106

Agent Platform Takeover

With operator.admin privileges, attacker modifies agent configurations, injects malicious tool definitions, and invokes the agent's existing integrations to exfiltrate data or pivot laterally.

AML.T0081

Initial Access

Attacker identifies an internet-exposed OpenClaw device pairing bootstrap endpoint and confirms it is reachable without authentication.

AML.T0049

Token Capture

Attacker obtains a valid bootstrap setup code through network interception, a leaked provisioning document, or observation of a legitimate device pairing workflow.

AML.T0091.000

Replay Escalation

Attacker submits the captured bootstrap code to the verification API repeatedly before approval completes, incrementally escalating pending pairing scopes until operator.admin is reached.

AML.T0106

Agent Platform Takeover

With operator.admin privileges, attacker modifies agent configurations, injects malicious tool definitions, and invokes the agent's existing integrations to exfiltrate data or pivot laterally.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.3.13 or later; the fix is in commit 1803d16d5cec970c54b0e1ac46b31b1cbade335c.
Immediate workaround if patching is blocked: restrict device pairing and bootstrap verification endpoints at the network perimeter (firewall/WAF, VPN-only access) to prevent unauthenticated network reach.
Detection: Instrument application logs to alert on repeated verification submissions of the same bootstrap code within a single pairing session — this is the canonical attack signature for CWE-294 replay abuse.
Audit: Review all operator.admin account grants created since OpenClaw was deployed; revoke any suspicious grants and trace their originating pairing sessions.
Inventory: Enumerate all OpenClaw instances in your environment and prioritize internet-exposed deployments for emergency patching.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.4.1 - Information Access Restriction

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to inventory AI risks

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32987?

OpenClaw before 2026.3.13 contains an authentication replay vulnerability (CWE-294) in its device bootstrap pairing process that allows any unauthenticated network attacker to submit a captured setup code multiple times before approval, incrementally escalating pairing scope until operator.admin access is granted. The CVSS 9.8 profile is worst-case: network-accessible with zero privileges required, no user interaction, and full C/I/A impact, making this trivially weaponizable against any exposed OpenClaw deployment. Although EPSS sits at 0.35% with no public exploit or KEV listing yet, this package carries a documented history of active abuse — AIID #1368 records malicious OpenClaw skills delivering credential stealers via ClawHub — and 396 prior CVEs signal systemic security debt in a platform that manages privileged agent operations. Upgrade to 2026.3.13 immediately; if patching is blocked, restrict bootstrap pairing endpoints to trusted network segments and alert on duplicate code verification attempts against the same pairing session.

Is CVE-2026-32987 actively exploited?

No confirmed active exploitation of CVE-2026-32987 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32987?

1. Patch: Upgrade OpenClaw to 2026.3.13 or later; the fix is in commit 1803d16d5cec970c54b0e1ac46b31b1cbade335c. 2. Immediate workaround if patching is blocked: restrict device pairing and bootstrap verification endpoints at the network perimeter (firewall/WAF, VPN-only access) to prevent unauthenticated network reach. 3. Detection: Instrument application logs to alert on repeated verification submissions of the same bootstrap code within a single pairing session — this is the canonical attack signature for CWE-294 replay abuse. 4. Audit: Review all operator.admin account grants created since OpenClaw was deployed; revoke any suspicious grants and trace their originating pairing sessions. 5. Inventory: Enumerate all OpenClaw instances in your environment and prioritize internet-exposed deployments for emergency patching.

What systems are affected by CVE-2026-32987?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Agent orchestration systems, Device-connected AI deployments, Multi-agent systems.

What is the CVSS score for CVE-2026-32987?

CVE-2026-32987 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksAgent orchestration systemsDevice-connected AI deploymentsMulti-agent systems

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.4.1

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.

Exploitation Scenario

An attacker targeting an organization using OpenClaw for AI agent orchestration scans for exposed device pairing bootstrap endpoints. After obtaining a valid setup code — via network interception on an unencrypted segment, a leaked provisioning document, or observation during a legitimate pairing workflow — the attacker replays the code against the verification API in rapid succession before the pairing approval completes. Each replay call increments the pending pairing scope, escalating privileges until operator.admin is achieved. The attacker then uses their operator.admin session to inject malicious tool definitions into the agent configuration, redirect agent API calls to an adversary-controlled endpoint, or invoke the agent's existing integrations (cloud storage, communication tools, internal APIs) to exfiltrate data or establish persistence — mirroring the credential theft pattern documented in AIID #1368 against the same platform.

Weaknesses (CWE)

CWE-294 Authentication Bypass by Capture-replay

CWE-294 — Authentication Bypass by Capture-replay: A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

[Architecture and Design] Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
[Architecture and Design] Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.

Source: MITRE CWE corpus.