Incorrect authorization in OpenClaw - #VU126836
Published: April 22, 2026
Vulnerability identifier: #VU126836
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access pairing state information and approve or operate on unrelated pending device pairing requests.
The vulnerability exists due to incorrect authorization in pairing management actions when handling paired-device pairing requests within the same gateway scope. A remote user can use a paired-device session with limited pairing scope to access pairing state information and approve or operate on unrelated pending device pairing requests.
The issue is limited to same-gateway paired-device sessions and is not a remote unauthenticated issue.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.4.20