GitHub Advisoryadvisory · npm

GHSA-2x4x-cc5g-qmmg OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

MEDIUM Published 2026-04-01 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-33577
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863
Reviewed
2026-04-01

Affected packages

• npm openclaw: < 2026.3.28 → fixed in 2026.3.28

Description

Summary The node pairing approval path did not consistently enforce that the approving caller already held every scope requested by the node. Impact A lower-privileged operator could approve a pending node request for broader scopes and extend privileges onto the paired node. Affected Component `src/infra/node-pairing.ts, src/gateway/server-methods/nodes.ts` Fixed Versions • Affected: `= 2026.3.28` • Latest stable `2026.3.28` contains the fix. Fix Fixed by commit `4d7cc6bb4f` (`gateway: restrict node pairing approvals`). OpenClaw thanks @AntAISecurityLab for reporting.

Related

Alias · CVE (1)

  • CVE-2026-33577 OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References