GitHub Advisoryadvisory · npm

GHSA-xj9w-5r6q-x6v4 OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md

HIGH Published 2026-04-03 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-41352
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862, CWE-863
Reviewed
2026-04-03

Affected packages

• npm openclaw: < 2026.3.31 → fixed in 2026.3.31

Description

Summary Device-Paired Node Skips Node Scope Gate → Host RCE.md Current Maintainer Triage • Status: open • Normalized severity: high • Assessment: Real in shipped v2026.3.28 because a merely device-paired node could expose node commands without node pairing, but high is sufficient given the pairing/setup prerequisites. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version: `2026.3.31` • Vulnerable version range: `= 2026.3.31` • First stable tag containing the fix: `v2026.3.31` Fix Commit(s) • `3886b65ef21d02808c1a106fa1f9f69e22f71c32` — 2026-03-30T17:29:28+01:00 OpenClaw thanks @AntAISecurityLab for reporting.

Related

Alias · CVE (1)

  • CVE-2026-41352 OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate… vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References