GHSA-67mf-f936-ppxf

Source

https://github.com/advisories/GHSA-67mf-f936-ppxf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-67mf-f936-ppxf/GHSA-67mf-f936-ppxf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-67mf-f936-ppxf

Aliases

CVE-2026-42426

Downstream

MINI-wf4p-4263-fff3

Published

2026-04-09T17:36:33Z

Modified

2026-05-06T02:51:09.992533Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

Details

Impact

OpenClaw node.pair.approve placed in operator.write scope instead of operator.pairing allows unprivileged pairing approval.

The pairing approval method accepted operator.write instead of the narrower pairing scope and admin requirement for exec-capable nodes.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= v2026.04.01
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @nicky-cc of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

Database specific

{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-269",
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-09T17:36:33Z",
    "nvd_published_at": "2026-04-28T19:37:46Z"
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2026.4.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-67mf-f936-ppxf/GHSA-67mf-f936-ppxf.json"