Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-33577
8.1 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): NONE
OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve
OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in node-pairing.ts to extend privileges onto paired nodes beyond their authorization level.
References
-
GitHub Security Advisory (GHSA-2x4x-cc5g-qmmg) third-party-advisory
-
Patch Commit patch
Affected products
OpenClaw
- <2026.3.28
- ==2026.3.28
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>