Node Pairing Reconnection Vulnerability in OpenClaw: Approval Scope Confusion
Summary
GHSA-83w9-h5wv-j9xm: OpenClaw: Node pairing reconnection could confuse approval scope state. Affects openclaw versions < 2026.5.27. Fixed in 2026.5.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source software package designed for managing node pairings and facilitating secure communication between nodes in a network. It allows operators to establish trusted connections and manage permissions effectively. However, a vulnerability has been identified that can confuse the approval scope state during node pairing reconnections, potentially leading to unintended authority being granted to nodes.
Vulnerability Detail
The vulnerability arises from the way OpenClaw handles node pairing reconnections. In affected versions, a session involving a paired or reconnecting node can inadvertently mutate the pairing state, altering the approval scope decision. This could result in broader node authority being restored or presented than the operator intended, especially if lower-trust input can access that path. The severity of this issue is underscored by its CVSS score of 7.6, indicating a high level of risk.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5.27
This is the first release that contains the fix.
npm install openclaw@2026.5.27Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, revoke any unexpected node pairings and re-pair only trusted nodes until the patch is applied. Additionally, maintain narrow channel and tool allowlists, avoid sharing a Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
Conclusion
The OpenClaw vulnerability related to node pairing reconnections poses a significant risk by potentially altering approval scope states. It is crucial for operators to update to the patched version 2026.5.27 and implement recommended workarounds to safeguard their systems.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability involves confusion in the approval scope state during node pairing reconnections, which can lead to unintended authority being granted to nodes.
If exploited, this vulnerability could allow a node to gain broader authority than intended, potentially compromising the security of the network.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
Revoke unexpected node pairings, re-pair only trusted nodes, and disable the affected feature when not in use to mitigate risks.
The CVSS score of this vulnerability is 7.6, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
