요약
- CVE-2026-35639은(는) openclaw (openclaw), openclaw에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.46%, 전체 취약점의 39.8%보다 높음.
- 조치: 2026.3.22 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.22
| 2026.3.22
|
| openclaw npm | < 2026.3.22
| 2026.3.22
|
Description
Summary
device.pair.approve allowed an operator.pairing approver to approve a pending device request for broader operator scopes than the approver actually held.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
- Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
fc2d29ea926f47c428c556e92ec981441228d2a4
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- src/gateway/server-methods/devices.ts now threads caller scopes into device.pair.approve.
- src/infra/device-pairing.ts now rejects requested operator scopes that exceed the approver-held operator scope set.
OpenClaw thanks @zpbrent for reporting.
NVD description
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can exploit insufficient scope validation to escalate privileges to operator.admin and achieve remote code execution on the Node infrastructure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free