CVE-2026-32905 OpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command

OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat command access can create setup codes to enroll...

CVE-2026-32905

OpenClaw versions before 2026.5.4 contain an authorization bypass in the bundled device-pair plugin that lets non-owner users with chat command access issue device‑pairing bootstrap codes without proper scope validation. Attackers can enroll devices with operator/node capabilities by creating set...

PT-2026-44891

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.4 Description An authorization bypass exists in the bundled device-pair plugin. This issue allows non-owner authorized chat senders to issue device-pairing bootstrap codes because the system fails to perform...

EUVD-2022-1232

Malicious code in bioql PyPI...

PT-2019-3143

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Twistlock versions 19.07.358 and earlier Description The issue is related to insufficient access control in the Palo Alto Networks Twistlock complex for cloud services and platform protection. It allows a remote attacker to...