Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairing approval restrictions to gain unauthorized access to exec-capable nodes.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42426 Improper Authorization in OpenClaw Before 2026.4.8 Node Pairing Approval https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42426
Post summary
The notice identifies CVE-2026-42426, detailing an improper authorization vulnerability affecting OpenClaw prior to version 2026.4.8.
CVE-2026-42426 OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower oper… https://www.cve.org/CVERecord?id=CVE-2026-42426
Post summary
The text announces that OpenClaw versions before 2026.4.8 contain an improper authorization flaw involving the node.pair.approve method and operator.write scope; it provides technical details but no PoC, exploit, patch, or active exploitation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |