N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5wj5-87vq-39xm

GHSA-5wj5-87vq-39xm: OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement

Impact

Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement.

A previously paired node could reconnect with a broader command set, including exec-capable commands, without forcing the operator/admin re-pairing path.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <=2026.4.5
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @zsxsoft and @KeenSecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5wj5-87vq-39xm

GHSA-5wj5-87vq-39xm:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.8	2026.4.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the provided commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5, which is stated to be the fix for the vulnerability. The commit modifies the fetchWithSsrFGuard function in src/infra/net/fetch-guard.ts. The vulnerability description indicates a privilege escalation issue during node reconnect. The patch alters the DNS pinning logic within fetchWithSsrFGuard. Specifically, it skips the DNS pinning when a trusted proxy is configured. This implies that the vulnerability is triggered through the DNS pinning process in the original code. Therefore, fetchWithSsrFGuard is the function that contains the vulnerable logic. The exploit likely involves a malicious node initiating a reconnect, which causes the server to call fetchWithSsrFGuard with parameters that exploit the flawed DNS pinning to bypass scope checks and gain admin-level commands.

Vulnerable functions

fetchWithSsrFGuard

src/infra/net/fetch-guard.ts

The vulnerability is that a previously paired node could reconnect with a broader command set, including exec-capable commands, without forcing the operator/admin re-pairing path. The patch fixes this by modifying the `fetchWithSsrFGuard` function. The change involves skipping DNS pinning when a trusted environment proxy is configured. In the vulnerable version, DNS pinning was always performed, which could be exploited during the node reconnect process to bypass authorization and escalate privileges. The function `fetchWithSsrFGuard` is therefore the vulnerable function as it contained the logic that was exploited.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.