CVE-2026-42422

MEDIUM

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

Published April 9, 2026Updated May 6, 2026Source: osv

Summary

## Impact OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing. Device token rotation could mint or preserve roles/scopes that had not gone through the intended pairing approval. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= v2026.04.01` - Patched versions: `2026.4.8` ## Fix The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`. ## Verification The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary. ## Credits Thanks @nicky-cc of Tencent zhuque Lab ([https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard)) for reporting.

Remediation

Upgrade to the fixed version using your package manager.

npm

Update openclaw to 2026.4.8 or later

npm install openclaw@2026.4.8

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
openclaw	npm	All versions	2026.4.8

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-863
Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-42422?: OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-42422?: CVE-2026-42422 affects openclaw. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-42422 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-whf9-3hcx-gq54

Related CVEs

CVE-2026-32013
CRITICAL
OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write
CVE-2026-28454
CRITICAL
OpenClaw has a potential access-group authorization bypass if channel type lookup fails
CVE-2026-44109
CRITICAL
OpenClaw: Feishu webhook and card-action validation now fail closed
CVE-2026-43530
HIGH
OpenClaw: busybox and toybox applet execution weakened exec approval binding
CVE-2026-45006
HIGH
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
CVE-2026-35643
HIGH
OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface
CVE-2026-53807
HIGH
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
CVE-2026-32038
MEDIUM
OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies