CVE-2026-42426

· HIGHAnalyzed

← All CVEs

CVSS v3.1

8.8

CVSS v4.0

8.7

EPSS

0.28%

Published

Apr 28, 2026

Modified

Apr 30, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairing approval restrictions to gain unauthorized access to exec-capable nodes.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-863

Affected Products (1)

openclaw · openclaw (up to 2026.4.8)vulnerable

References (3)

https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5

Patch

https://github.com/openclaw/openclaw/security/advisories/GHSA-67mf-f936-ppxf

Vendor Advisory

https://www.vulncheck.com/advisories/openclaw-improper-authorization-in-node-pair-approve-via-operator-write-scope

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs