CVE-2026-32987 — OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device…¶

Key facts

CVE-2026-32987 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-32987
Severity	Critical (9.8)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32987/

Details¶

CVE-2026-32987 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-32987
CVSS Score	9.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32987/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-32987

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/commit/1803d16d5cec970c54b0e1ac46b31b1cbade335c
https://github.com/openclaw/openclaw/security/advisories/GHSA-63f5-hhc7-cx6p
https://www.vulncheck.com/advisories/openclaw-bootstrap-setup-code-replay-via-device-pairing

Generated by PoC Generator on 2026-04-10T16:03:12.664761769

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-32987, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-32987 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-32987 OpenClaw bootstrap code replay attack attempt"; flow:established,to_server; content:"bootstrap"; content:"device-bootstrap"; content:"pairing"; content:"verify"; pcre:"/bootstrap.*code.*replay|pairing.*verification.*replay/i"; classtype:attempted-admin; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32987 OpenClaw privilege escalation via bootstrap replay"; flow:established,to_server; content:"operator.admin"; content:"bootstrap"; content:"escalate"; pcre:"/operator\.admin.*bootstrap|bootstrap.*operator\.admin/i"; classtype:successful-admin; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32987 OpenClaw multiple bootstrap verification attempts"; flow:established,to_server; content:"bootstrap"; content:"verify"; content:"pending"; pcre:"/verify.*bootstrap.*verify|bootstrap.*pending.*pairing/i"; threshold:type both, track by_src, count 3, seconds 60; classtype:attempted-admin; sid:1000002; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32987 OpenClaw device pairing scope escalation"; flow:established,to_server; content:"pairing"; content:"scope"; content:"escalate"; content:"bootstrap"; pcre:"/pairing.*scope.*escalate|escalate.*pairing.*scope/i"; classtype:attempted-admin; sid:1000003; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32987_OpenClaw_Bootstrap_Replay_Attack
{
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw bootstrap setup code replay attack exploitation"
        cve = "CVE-2026-32987"
        severity = "high"
        date = "2024-12-19"

    strings:
        $file_path = "src/infra/device-bootstrap.ts"
        $bootstrap_replay1 = "bootstrap" nocase
        $bootstrap_replay2 = "pairing verification" nocase
        $bootstrap_replay3 = "device-bootstrap" nocase

        $exploit_pattern1 = /bootstrap.*code.*replay/i
        $exploit_pattern2 = /pairing.*verification.*escalate/i
        $exploit_pattern3 = /operator\.admin.*privilege/i

        $code_func1 = "verifyBootstrapCode"
        $code_func2 = "validatePairingScope"
        $code_func3 = "escalatePendingScope"

        $hex_bootstrap = { 62 6f 6f 74 73 74 72 61 70 }
        $hex_pairing = { 70 61 69 72 69 6e 67 }
        $hex_admin = { 6f 70 65 72 61 74 6f 72 2e 61 64 6d 69 6e }

        $typescript_indicators = ".ts" ascii
        $openclaw_indicators = "OpenClaw" ascii nocase

    condition:
        (
            ($file_path or $openclaw_indicators) and
            (
                any of ($bootstrap_replay*) or
                any of ($exploit_pattern*) or
                any of ($code_func*) or
                any of ($hex_*)
            )
        ) or
        (
            $typescript_indicators and
            2 of ($bootstrap_replay*, $exploit_pattern*, $code_func*)
        )
}

rule CVE_2026_32987_OpenClaw_Privilege_Escalation_Memory
{
    meta:
        author = "Security Engineer"
        description = "Detects in-memory artifacts of OpenClaw bootstrap replay privilege escalation"
        cve = "CVE-2026-32987"
        severity = "medium"
        date = "2024-12-19"

    strings:
        $mem_pattern1 = "bootstrap code verified multiple times"
        $mem_pattern2 = "pending pairing scope escalation"
        $mem_pattern3 = "operator.admin privilege granted"

        $api_call1 = "replayBootstrapVerification"
        $api_call2 = "escalateToOperatorAdmin"
        $api_call3 = "bypassPairingApproval"

        $error_msg1 = "Bootstrap verification failed - replay detected"
        $error_msg2 = "Unauthorized privilege escalation attempt"
        $error_msg3 = "Invalid pairing scope modification"

        $hex_sequence = { 76 65 72 69 66 79 42 6f 6f 74 73 74 72 61 70 43 6f 64 65 }

    condition:
        2 of them
}

rule CVE_2026_32987_OpenClaw_Attack_Artifacts
{
    meta:
        author = "Security Engineer"
        description = "Detects file artifacts related to OpenClaw bootstrap replay exploitation"
        cve = "CVE-2026-32987"
        severity = "medium"
        date = "2024-12-19"

    strings:
        $log_entry1 = /bootstrap.*verified.*\d+.*times/i
        $log_entry2 = /pairing.*scope.*escalated.*operator\.admin/i
        $log_entry3 = /device.*bootstrap.*replay.*detected/i

        $config_vuln1 = "allowBootstrapReplay" ascii
        $config_vuln2 = "skipPairingApproval" ascii
        $config_vuln3 = "autoEscalatePrivileges" ascii

        $version_vuln = /OpenClaw.*20[0-2][0-6]\.[0-2]\.(1[0-2]|[0-9])/

        $exploit_code = /for.*bootstrap.*replay.*escalate/i

    condition:
        any of ($log_entry*) or
        any of ($config_vuln*) or
        $version_vuln or
        $exploit_code
}

:material-file-download: prevention/yara.yar

# CVE-2026-32987 Protection: Prevent bootstrap code replay attacks
# Block repeated bootstrap verification attempts

# Rate limiting for bootstrap endpoints
limit_req_zone $binary_remote_addr zone=bootstrap_limit:10m rate=5r/m;
limit_req_zone $request_uri zone=bootstrap_uri_limit:10m rate=3r/m;

# Track bootstrap attempts per IP
map $remote_addr $bootstrap_attempts {
    default 0;
}

# Main protection block for device bootstrap endpoints
location ~* ^/api/.*/(bootstrap|device-pairing|verification)/ {
    # Apply rate limiting
    limit_req zone=bootstrap_limit burst=2 nodelay;
    limit_req zone=bootstrap_uri_limit burst=1 nodelay;

    # Block suspicious bootstrap replay patterns
    if ($request_method = POST) {
        set $bootstrap_block 0;
    }

    # Block requests with multiple bootstrap codes in body
    if ($request_body ~* "bootstrap.*bootstrap") {
        return 403;
    }

    # Block rapid successive POST requests with same bootstrap parameters
    if ($args ~* "bootstrap_code=([^&]+).*bootstrap_code=\1") {
        return 403;
    }

    # Block requests attempting to replay verification tokens
    if ($http_authorization ~* "Bearer\s+([a-zA-Z0-9\-_]+).*\1") {
        return 403;
    }

    # Additional security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Cache-Control "no-store, no-cache, must-revalidate" always;

    proxy_pass http://backend;
}

# Specific protection for bootstrap setup endpoint
location ~* /api/.*/device-bootstrap\.ts {
    deny all;
    return 404;
}

# Block direct access to bootstrap verification with suspicious patterns
location ~* ^/api/.*/(verify|approve).*bootstrap {
    # Enhanced rate limiting for verification endpoints
    limit_req zone=bootstrap_limit burst=1 nodelay;

    # Block requests with privilege escalation indicators
    if ($request_body ~* "(operator\.admin|escalate|privilege)") {
        return 403;
    }

    # Block replay attempts with duplicate verification data
    if ($request_body ~* "verification_id.*verification_id") {
        return 403;
    }

    # Require specific headers for legitimate requests
    if ($http_x_csrf_token = "") {
        return 403;
    }

    proxy_pass http://backend;
}

# Block requests attempting to access pending pairing scopes
location ~* ^/api/.*/pairing.*(pending|scope) {
    # Block privilege escalation attempts
    if ($args ~* "(admin|operator|elevate|escalate)") {
        return 403;
    }

    if ($request_body ~* "scope.*admin") {
        return 403;
    }

    proxy_pass http://backend;
}

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-32987 - OpenClaw Bootstrap Code Replay Attack Prevention

# Rule 1000000: Block requests to device bootstrap endpoints with suspicious patterns
SecRule REQUEST_URI "@contains /device-bootstrap" \
    "id:1000000,\
    phase:1,\
    block,\
    msg:'CVE-2026-32987: Potential OpenClaw bootstrap endpoint access detected',\
    logdata:'URI: %{REQUEST_URI}',\
    severity:'CRITICAL',\
    tag:'cve-2026-32987',\
    tag:'bootstrap-replay'"

# Rule 1000001: Rate limiting for bootstrap verification attempts
SecRule REQUEST_URI "@rx /(?:api/|v\d+/)?(?:device-)?bootstrap(?:/verify|/pair)?" \
    "id:1000001,\
    phase:1,\
    pass,\
    msg:'CVE-2026-32987: Bootstrap verification rate limiting',\
    setvar:'ip.bootstrap_attempts=+1',\
    expirevar:'ip.bootstrap_attempts=300',\
    tag:'cve-2026-32987',\
    tag:'rate-limiting'"

# Rule 1000002: Block excessive bootstrap verification attempts
SecRule IP:BOOTSTRAP_ATTEMPTS "@gt 3" \
    "id:1000002,\
    phase:1,\
    block,\
    msg:'CVE-2026-32987: Excessive bootstrap verification attempts - potential replay attack',\
    logdata:'Attempts: %{ip.bootstrap_attempts} from IP: %{REMOTE_ADDR}',\
    severity:'CRITICAL',\
    tag:'cve-2026-32987',\
    tag:'replay-attack'"

# Rule 1000003: Detect repeated bootstrap code submissions
SecRule ARGS_POST "@rx ^[A-Za-z0-9+/]{16,}={0,2}$" \
    "id:1000003,\
    phase:2,\
    pass,\
    msg:'CVE-2026-32987: Potential bootstrap code detected',\
    setvar:'ip.bootstrap_code_%{ARGS_POST}=+1',\
    expirevar:'ip.bootstrap_code_%{ARGS_POST}=600',\
    tag:'cve-2026-32987',\
    tag:'bootstrap-code'"

# Rule 1000004: Block reuse of same bootstrap code
SecRule IP:/^bootstrap_code_/ "@gt 1" \
    "id:1000004,\
    phase:2,\
    block,\
    msg:'CVE-2026-32987: Bootstrap code reuse detected - potential replay attack',\
    logdata:'Code reuse count: %{MATCHED_VAR} from IP: %{REMOTE_ADDR}',\
    severity:'CRITICAL',\
    tag:'cve-2026-32987',\
    tag:'code-reuse'"

# Rule 1000005: Monitor for privilege escalation patterns in requests
SecRule REQUEST_BODY "@rx (?:operator\.admin|admin|privilege|escalat|scope.*admin)" \
    "id:1000005,\
    phase:2,\
    pass,\
    msg:'CVE-2026-32987: Potential privilege escalation attempt in bootstrap request',\
    logdata:'Suspicious content: %{MATCHED_VAR}',\
    severity:'WARNING',\
    tag:'cve-2026-32987',\
    tag:'privilege-escalation'"

# Rule 1000006: Block requests with multiple bootstrap codes in single request
SecRule ARGS_POST_NAMES "@rx bootstrap.*code" \
    "id:1000006,\
    phase:2,\
    pass,\
    msg:'CVE-2026-32987: Multiple bootstrap parameters detected',\
    setvar:'tx.bootstrap_param_count=+1',\
    tag:'cve-2026-32987'"

SecRule TX:BOOTSTRAP_PARAM_COUNT "@gt 1" \
    "id:1000007,\
    phase:2,\
    block,\
    msg:'CVE-2026-32987: Multiple bootstrap codes in single request - potential replay attack',\
    logdata:'Parameter count: %{tx.bootstrap_param_count}',\
    severity:'CRITICAL',\
    tag:'cve-2026-32987',\
    tag:'multiple-codes'"

# Rule 1000008: Detect suspicious user agents targeting OpenClaw
SecRule REQUEST_HEADERS:User-Agent "@rx (?:curl|wget|python|automation|script)" \
    "id:1000008,\
    phase:1,\
    pass,\
    msg:'CVE-2026-32987: Suspicious user agent for bootstrap endpoint',\
    chain"
    SecRule REQUEST_URI "@contains bootstrap" \
        "t:lowercase,\
        block,\
        msg:'CVE-2026-32987: Automated tool accessing bootstrap endpoint',\
        logdata:'User-Agent: %{REQUEST_HEADERS.User-Agent}',\
        severity:'HIGH',\
        tag:'cve-2026-32987',\
        tag:'automated-attack'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-32987?¶

CVE-2026-32987 is a Critical (9.8) vulnerability: OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32987?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32987?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.