Executive brief
OpenClaw is a device management platform that handles device pairing and access control. A flaw in the device approval workflow allows a user with basic pairing privileges to approve new device requests requesting higher-level access including full administrator rights, bypassing the intended scope restrictions. An attacker exploiting this can gain unauthorized administrative access to managed systems.
Technical details
OpenClaw versions before 2026.3.28 contain an authorization bypass vulnerability (CWE-863: Improper Authorization) in the /pair approve command path. The vulnerable code in extensions/device-pair/index.ts and src/infra/device-pairing.ts fails to forward caller scopes into the core approval check logic. An authenticated attacker with pairing privileges (but not admin privileges) can craft a device pairing request asking for elevated scopes including admin access, and then approve it without proper scope validation. The fix was released in version 2026.3.28 via commit 4ee4960de2. No exploitation in the wild has been reported, but the network-accessible attack vector and low privilege requirement make this a high-risk vulnerability.
Affected products
- OpenClaw OpenClaw before 2026.3.28
Timeline
- 2026-03-29: disclosed: Advisory published on GitHub
- 2026-03-28: patched: Fixed in version 2026.3.28