CVE-2026-41386 is a critical privilege escalation flaw (CVSS 9.1) in OpenClaw before 2026.3.22. Bootstrap setup codes are not bound to the intended device role and scope, so first use pairing can grant more than intended. Upgrade to 2026.3.22 or later.
What's affected
Per the GitHub advisory for the npm package openclaw, versions up to 2026.3.13-1 are listed as affected and the patched version is 2026.3.22 or newer. The record states the fix point as before 2026.3.22. The maintainers' note in the advisory calls it a real first use bootstrap privilege escalation bug that shipped fixed in v2026.3.22 and later.
How to check if you're exposed
npm ls openclaw
Check global installs and container images too. Then look at how you pair devices: any workflow where a bootstrap setup code is handed out and a new device claims it is in scope. Review the roles and scopes that existing paired devices hold, and compare them with what you intended to grant.
What to do now
- Upgrade OpenClaw to 2026.3.22 or later.
- Review paired devices and their roles and scopes, and remove any that are broader than needed or unfamiliar.
- Treat unused bootstrap setup codes as secrets and revoke any that are outstanding.
- Re-pair devices after the upgrade if you cannot tell how they were granted.
Why it matters
The record lists CWE-648, incorrect use of privileged APIs. In plain terms, a code that proves "you may join" was not tied to the question "as what". The code should carry the role and scope it was issued for, and the server should enforce them at the moment of use.
Pairing and enrollment flows are a common weak spot because they happen before normal authentication exists. Bind every setup token to an identity, a role and an expiry. The record does not flag this CVE as known exploited.
Quick check
Does it require an account first?
The vector shows no privileges required, and the issue arises during first use pairing. Check the advisory for the exact flow in your setup.
Sources
Last reviewed: 19 October 2026.
