CVE-2026-42426:
CVE-2026-42426 is an improper authorization vulnerability in OpenClaw before version 2026.4.8 where the `node.pair.approve` method incorrectly accepts the broad `operator.write` scope instead of the narrower `operator.pairing` scope, enabling privilege escalation to exec-capable nodes.
Score
A numerical rating that indicates how dangerous this vulnerability is.
8.8High- Published Date:Apr 28, 2026
- CISA KEV Date:*No Data*
- Industries Affected:20
Exploitability
- Score:2.8
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:LOW
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:5.9
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
CVE-2026-42426 is an improper authorization vulnerability in OpenClaw before version 2026.4.8 where the `node.pair.approve` method incorrectly accepts the broad `operator.write` scope instead of the narrower `operator.pairing` scope, enabling privilege escalation to exec-capable nodes.
Overview
CVE-2026-42426 affects OpenClaw before 2026.4.8 and stems from an incorrect authorization scope check in the `node.pair.approve` method. Rather than enforcing the purpose-specific `operator.pairing` scope, the method accepts the broader `operator.write` scope, violating the principle of least privilege. Authenticated users possessing `operator.write` permissions can exploit this flaw to approve node pairing without legitimate authorization, ultimately gaining access to exec-capable nodes. This can result in complete compromise of the affected node, impacting confidentiality, integrity, and availability. The vulnerability requires no user interaction, no elevated complexity, and is remotely exploitable, making it a significant security risk in any deployment of the affected software.
Remediation
- Users of OpenClaw should upgrade to version 2026.4.8 or later, which introduces the corrected authorization scope check that restricts `node.pair.approve` to only users holding the `operator.pairing` scope. Organizations unable to immediately upgrade should audit their user and permission configurations to ensure that `operator.write` permissions are granted only to fully trusted personnel and that access to exec-capable nodes is strictly monitored. The fix is available via the referenced commit on the official GitHub repository.
References
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
