Executive brief
OpenClaw is a Node.js package used for managing node pairing and approval scopes in distributed systems. A vulnerability in the node pairing reconnection logic allows paired nodes to manipulate their authority scope, potentially restoring broader permissions than intended. This could enable attackers to bypass approval restrictions and gain unauthorized access to protected resources.
Technical details
This vulnerability is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in OpenClaw's node pairing reconnection logic. When a node reconnects after a pairing, the approval scope state can be mutated in a way that bypasses intended restrictions. The vulnerability requires the affected node pairing feature to be enabled and reachable. An attacker with ability to manipulate reconnection timing or session state can restore or present broader node authority than the operator intended, potentially escalating privileges within the paired node topology. The vulnerability is patched in version 2026.5.27.
Affected products
- OpenClaw OpenClaw before 2026.5.27
Timeline
- 2026-05-28: disclosed
- 2026-05-27: patched