PT-2026-35804 · Openclaw · Openclaw

Nicky · Published 2026-04-09 · Updated 2026-04-28 · CVE-2026-42426

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description An improper authorization issue exists where the 'node.pair.approve' method accepts the operator.write scope instead of the more restrictive operator.pairing scope. This allows users with operator.write permissions to bypass pairing approval restrictions and approve node pairing, potentially gaining unauthorized access to nodes capable of executing commands.

Recommendations Update to version 2026.4.8. As a temporary workaround, restrict the use of the operator.write scope for unprivileged users to prevent unauthorized node pairing approval.

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2026-42426

GHSA-67MF-F936-PPXF

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-67mf-f936-ppxf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67mf-f936-ppxf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42426 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2049227498206978512 · Twitter Post
• https://vulncheck.com/advisories/openclaw-improper-authorization-in-node-pair-approve-via-operator-write-scope · Note
• https://twitter.com/VulmonFeeds/status/2049273301470515385 · Twitter Post