---
cve: "CVE-2026-41386"
severity: "CRITICAL"
cvss: 9.1
epss: "0.3%"
vendor: "OpenClaw"
kev: false
exploited: false
published: "2026-04-28 18:09:48"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T15:19:28+01:00"
---

# CVE-2026-41386

> 9.1 CRITICAL · 🧪 PoC

## Beschreibung

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-04-29 12:49:41
- CNA-CVSS: **9.1** (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-648** — Incorrect Use of Privileged APIs
  The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

## Angriffsmuster (CAPEC)

- [CAPEC-107 — Cross Site Tracing](https://capec.mitre.org/data/definitions/107.html) _(Severity: Very High)_
- [CAPEC-234 — Hijacking a privileged process](https://capec.mitre.org/data/definitions/234.html) _(Severity: Medium)_

## Patch verfügbar (OSV)

- e7d11f6c33e223a0dd8a21cfe01076bd76cef87a (Commit)
- a600c72ed7d0045a27f58bf031d2b36ecb0141c9 (Commit)

## BSI-Hinweise (deutsch)

- [OpenClaw: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-0948) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.

## Referenzen

- <https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7>
- <https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9>
- <https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-41386/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_