| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.4.20 | 2026.4.20 |
| openclaw | < 2026.4.20 | 2026.4.20 |
openclaw (npm)< 2026.4.202026.4.20A paired device session with limited pairing scope could enumerate global pairing state and act on pairing requests that belonged to another device within the same gateway scope ceiling.
This is a same-gateway paired-device authorization bug, not a remote unauthenticated issue. Severity is low.
Pairing management actions are now limited to the caller device, so non-admin paired-device sessions cannot approve or operate on unrelated pending device requests.
Fix commit:
5a12f30441d5b0b151f550daa2c5c9e8db61e2e6Fixed in OpenClaw 2026.4.20.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free