Description
OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.3.31 | 2026.3.31 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | < 2026.3.31 | 2026.3.31 | GHSA-xj9w-5r6q-x6v4 |
Advisories 1
- WID-SEC-2026-0980 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 28, 2026
References
- GitHub Security Advisory (GHSA-xj9w-5r6q-x6v4) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass third-party-advisory