CVE-2026-42426CWE-863

OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope

High · published April 28, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairing approval restrictions to gain unauthorized access to exec-capable nodes.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00516 · 43.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-28T18:10Z
EPSS history
Timeline
  • 28 APR 18:10Z
    OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope
    cvelistv5