| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.1 | 2026.3.1 |
A paired node could supply Unicode-confusable platform or deviceFamily metadata that passed metadata pinning but classified differently for command policy resolution, broadening default node command allowlists.
This is a policy-bypass issue within the paired-node trust boundary and can expand node command availability beyond intended defaults.
Node metadata canonicalization was hardened against confusables, and unknown platform defaults were made conservative (excluding system.run and system.which unless explicitly allowlisted).
<= 2026.2.262026.3.1Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free