https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:48:08 +0000 https://vulnerability.circl.lu/vuln/cve-2026-33577 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in node-pairing.ts to extend privileges onto paired nodes beyond their authorization level.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in node-pairing.ts to extend privileges onto paired nodes beyond their authorization level.</p> https://vulnerability.circl.lu/vuln/cve-2026-33577 https://vulnerability.circl.lu/vuln/ghsa-2x4x-cc5g-qmmg <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>The node pairing approval path did not consistently enforce that the approving caller already held every scope requested by the node.</p> <p>## Impact</p> <p>A lower-privileged operator could approve a pending node request for broader scopes and extend privileges onto the paired node.</p> <p>## Affected Component</p> <p>`src/infra/node-pairing.ts, src/gateway/server-methods/nodes.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `4d7cc6bb4f` (`gateway: restrict node pairing approvals`).</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>The node pairing approval path did not consistently enforce that the approving caller already held every scope requested by the node.</p> <p>## Impact</p> <p>A lower-privileged operator could approve a pending node request for broader scopes and extend privileges onto the paired node.</p> <p>## Affected Component</p> <p>`src/infra/node-pairing.ts, src/gateway/server-methods/nodes.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `4d7cc6bb4f` (`gateway: restrict node pairing approvals`).</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-2x4x-cc5g-qmmg