N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xj9w-5r6q-x6v4

GHSA-xj9w-5r6q-x6v4: OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md

Summary

Device-Paired Node Skips Node Scope Gate → Host RCE.md

Current Maintainer Triage

Status: open
Normalized severity: high
Assessment: Real in shipped v2026.3.28 because a merely device-paired node could expose node commands without node pairing, but high is sufficient given the pairing/setup prerequisites.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

3886b65ef21d02808c1a106fa1f9f69e22f71c32 — 2026-03-30T17:29:28+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-xj9w-5r6q-x6v4

GHSA-xj9w-5r6q-x6v4:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the attachGatewayWsMessageHandler function located in src/gateway/server/ws-connection/message-handler.ts. This function is responsible for handling WebSocket connections from nodes to the gateway. The analysis of the patch 3886b65ef21d02808c1a106fa1f9f69e22f71c32 reveals a flaw in the authorization logic for node commands. In the vulnerable version, when a node connects, the code checks if the node is paired. If it is not (pairedNode is null), the logic incorrectly defaults to allowing any command present in the device-type-based allowlist, completely skipping the node-specific command authorization. The expression (pairedCommands === null || pairedCommands.has(cmd)) evaluates to true for unpaired nodes, thus granting permissions. This allows a remote attacker who can complete the initial device-pairing step to execute arbitrary commands on the host if a dangerous command like system.run is declared by the connecting node. The patch rectifies this by ensuring that if a node is not paired, its list of executable commands is empty. It also introduces a mechanism to automatically request node pairing on the first connection. The new logic correctly filters commands against the set of commands explicitly granted during the node pairing process, effectively mitigating the vulnerability.

Vulnerable functions

attachGatewayWsMessageHandler

src/gateway/server/ws-connection/message-handler.ts

The function `attachGatewayWsMessageHandler` contains flawed authorization logic when handling a new node connection. If a connecting node has performed device pairing but not node pairing, the `pairedNode` variable is null. This causes the `pairedCommands` variable to also be null. The subsequent filter condition `(pairedCommands === null || pairedCommands.has(cmd))` then evaluates to true for any command, bypassing the intended node-specific command authorization. This allows the node to execute any command that is declared and present in the platform-level allowlist, even if it hasn't been explicitly authorized through node pairing, leading to potential remote code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.