Executive brief
OpenClaw is a Node.js-based infrastructure automation and orchestration platform. A device-paired node can bypass access control mechanisms (the "node scope gate") to execute arbitrary commands on the host, leading to remote code execution. An attacker with device-pairing credentials can escalate privileges to run commands intended to be restricted, compromising the entire host system.
Technical details
This vulnerability is an authorization bypass (CWE-862, CWE-863) in OpenClaw's node scope gate mechanism. A device-paired node is able to skip or bypass the node scope gate access control, allowing execution of node commands that should be restricted. The vulnerability requires an attacker to already have device-pairing credentials or be in a position to establish such pairing, but once paired, no further authentication is needed to exploit the gate bypass. An unauthenticated or insufficiently-authorized attacker can achieve remote code execution on the affected host. The fix is available in version 2026.3.31 and later.
Affected products
- OpenClaw openclaw <=2026.3.28
Timeline
- 2026-04-03: disclosed: Advisory published
- 2026-03-30: patched: Fix committed, released in v2026.3.31