~ / search / GHSA-2x4x-cc5g-qmmg

GHSA-2x4x-cc5g-qmmg

OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-33577

Packages

EcosystemPackageAffectedFixed in
npm openclaw < 2026.3.28 2026.3.28

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary The node pairing approval path did not consistently enforce that the approving caller already held every scope requested by the node. ## Impact A lower-privileged operator could approve a pending node request for broader scopes and extend privileges onto the paired node. ## Affected Component `src/infra/node-pairing.ts, src/gateway/server-methods/nodes.ts` ## Fixed Versions - Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `4d7cc6bb4f` (`gateway: restrict node pairing approvals`). OpenClaw thanks @AntAISecurityLab for reporting.

References

External links from the advisory. They lead to third-party sites.