PT-2026-30773 · Npm · Openclaw

Published 2026-03-27 · Updated 2026-03-27

OSV

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Summary

Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

Affected Packages / Versions

• Package: openclaw
• Affected versions: <= 2026.3.24
• First patched version: 2026.3.25
• Latest published npm version at verification time: 2026.3.24

Details

Backend-labeled reconnects could previously self-request broader scopes and bypass pairing, allowing non-admin operators to reconnect as operator.admin. Commit d3d8e316bd819d3c7e34253aeb7eccb2510f5f48 removes the backend self-pairing skip and requires pairing when requested scopes exceed the approved baseline.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit d3d8e316bd819d3c7e34253aeb7eccb2510f5f48.

Fix Commit(s)

• d3d8e316bd819d3c7e34253aeb7eccb2510f5f48

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

GHSA-9HJH-FR4F-GXC4

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-9hjh-fr4f-gxc4 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9hjh-fr4f-gxc4 · Note
• https://github.com/openclaw/openclaw/commit/d3d8e316bd819d3c7e34253aeb7eccb2510f5f48 · Note