OpenClaw Patches 13 CVEs in April - Including Critical Device Pairing Flaw (CVSS 8.7)

OpenClaw has patched 13 vulnerabilities in its April security update, including a critical flaw in its device pairing flow that could let a paired device gain administrator-level access. The issue was rated CVSS 8.7, which puts it in the high-severity range and makes it the most serious bug in this month’s batch.

The flaw was in how OpenClaw handled authorization during pairing. According to the summary, the system failed to validate scope before granting operator-level sessions, which meant a device that had been paired could escalate beyond the permissions it should have had. In practical terms, a pairing step that should have limited what a device could do instead opened the door to full admin access.

That kind of bug matters because pairing is usually treated as a trust boundary. When a platform accepts a new device, it is supposed to assign only the privileges that device needs, and then keep those permissions contained. If the scope check is missing or broken, an attacker who can get a device paired, or take over a paired device, may be able to move from limited access to control over the whole instance.

The OpenClaw patch set is also notable for its size. Thirteen CVEs, short for Common Vulnerabilities and Exposures, landed in a single month, which is unusual for a project of this size. The curator’s summary describes that volume as rare for the project, suggesting April’s release was not a routine cleanup but a broad security response.

A CVE is a public identifier used to track a specific security flaw across vendors, researchers, and defenders. These identifiers help security teams compare notes, track patch status, and understand whether multiple reports refer to the same bug or to different issues in the same codebase.

A CVSS score, or Common Vulnerability Scoring System score, is a standard way to rate how serious a vulnerability is. Scores above 8 are generally treated as high severity, especially when they involve privilege escalation, which is when a user or device gains permissions beyond what it was originally supposed to have.

OpenClaw’s April fixes reflect the kind of pressure security-maintained software faces as it grows into real deployments. Features like device pairing are convenient, but they also widen the attack surface, because they create new paths for identity, trust, and access control to go wrong.

The pairing flaw is the clearest example in this batch because it sits directly at the point where devices are admitted into the system. If that gate does not correctly enforce scope, the rest of the permission model can be bypassed, which is why this bug drew the highest severity rating among the month’s patches.