CVE-2026-42422:

CVE-2026-42422 is a role bypass vulnerability in OpenClaw before version 2026.4.8 that allows authenticated attackers to mint tokens for unapproved roles via the `device.token.rotate` function.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Apr 28, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

CVE-2026-42422 is a role bypass vulnerability in OpenClaw before version 2026.4.8 that allows authenticated attackers to mint tokens for unapproved roles via the `device.token.rotate` function.

Overview

CVE-2026-42422 affects OpenClaw before version 2026.4.8 and stems from incorrect authorization logic in the `device.token.rotate` function. Specifically, the function fails to properly enforce the role-upgrade pairing approval process, allowing an authenticated attacker to generate tokens carrying roles and permission scopes that were never approved through the intended workflow. This grants the attacker capabilities beyond what was sanctioned, with high impact on confidentiality, integrity, and availability of the vulnerable system component. The vulnerability is network-exploitable with low privileges and requires no user interaction, making it a significant risk in any internet-exposed deployment of OpenClaw.

Remediation

Users of OpenClaw should upgrade to version 2026.4.8 or later, which contains a patch addressing the improper authorization check in the `device.token.rotate` function. The fix was introduced in commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`. Organizations unable to update immediately should restrict access to the token rotation functionality to trusted network segments or privileged users only, and audit existing device tokens for unauthorized role assignments or unexpected scopes as a precautionary measure.