CVE-2026-62218: Openclaw Authorization Bypass Vulnerability

CVE-2026-62218 Overview

CVE-2026-62218 is an authorization bypass vulnerability affecting OpenClaw versions 2026.1.20 through versions prior to 2026.5.27. The flaw exists in the device.pair.approve feature, which fails to enforce role-management checks on incoming callers. Lower-trust users can invoke privileged actions that should require stronger authorization. Attackers reach the affected feature through configured input paths exposed over the network, requiring only low-privileged authenticated access. The vulnerability is tracked under CWE-862 Missing Authorization.

Critical Impact
Authenticated attackers with low privileges can bypass role checks in the device.pair.approve feature to perform high-impact actions affecting confidentiality, integrity, and availability of the OpenClaw deployment.

Affected Products

OpenClaw 2026.1.20 and later versions prior to 2026.5.27
OpenClaw Node.js distributions matching cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Deployments exposing the device.pair.approve feature through configured input paths

Discovery Timeline

2026-07-17 - CVE-2026-62218 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-62218

Vulnerability Analysis

The vulnerability originates in the device.pair.approve handler within OpenClaw. This handler executes device pairing approval logic that grants trust between devices and elevates their operational capabilities. The handler does not verify that the calling identity holds the role required to approve pairings. Authenticated users with lower-trust roles can therefore invoke it directly and cause the system to treat their requests as originating from a privileged caller. Because pairing approval is a trust-establishing operation, downstream code that relies on the resulting state can be manipulated to affect confidentiality, integrity, and availability across the OpenClaw deployment.

Root Cause

The root cause is missing authorization enforcement, classified as CWE-862. The device.pair.approve code path validates authentication but omits the role-management check that gates privileged pairing operations. Input paths configured to route requests to this feature therefore reach the sensitive logic without the required role predicate being evaluated.

Attack Vector

Exploitation occurs over the network and does not require user interaction. The attacker authenticates with a low-privileged account and issues a request to any configured input path that resolves to device.pair.approve. The server processes the request without verifying that the caller holds the approver role. See the VulnCheck Authorization Bypass Advisory and the GitHub Security Advisory GHSA-8v95-qqcm-qp9h for protocol-level details of the affected endpoint.

Detection Methods for CVE-2026-62218

Indicators of Compromise

Requests to device.pair.approve originating from user identities that do not hold the pairing approver role.
Unexpected device pairing approvals in application audit logs, especially outside of normal administrator workflows.
Repeated invocations of pairing-related endpoints from a single low-privileged session in a short interval.

Detection Strategies

Correlate authentication logs with device.pair.approve invocations and alert when caller role does not include pairing approval rights.
Baseline legitimate pairing approval sources (admin accounts, automation service principals) and flag deviations.
Inspect configured input paths in front of OpenClaw for requests that reach the pairing feature without traversing administrative UI flows.

Monitoring Recommendations

Enable verbose audit logging for the device.pair.approve handler and forward records to a central log platform.
Monitor for changes to device trust state that are not accompanied by an administrator session.
Track OpenClaw versions in inventory and alert on any host still running a release between 2026.1.20 and 2026.5.27.

How to Mitigate CVE-2026-62218

Immediate Actions Required

Upgrade OpenClaw to version 2026.5.27 or later on every affected node.
Rotate credentials for any low-privileged account that may have accessed the device.pair.approve endpoint.
Review recent pairing approvals and revoke any that cannot be tied to an authorized administrator action.
Restrict network reachability of OpenClaw management interfaces to trusted administrative networks.

Patch Information

OpenClaw addressed the missing authorization check in version 2026.5.27. Refer to the GitHub Security Advisory GHSA-8v95-qqcm-qp9h for the fixed release and upgrade guidance. As of the NVD publication date, no public proof-of-concept exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.248%.

Workarounds

Place the OpenClaw management surface behind a reverse proxy that enforces role-based access on paths reaching device.pair.approve until patching is complete.
Disable or gate the configured input paths that expose pairing approval to non-administrative users.
Reduce the privilege footprint of application accounts so that compromise of a low-trust user yields no route to sensitive endpoints.

bash

# Verify installed OpenClaw version and upgrade to the fixed release
npm ls openclaw
npm install openclaw@2026.5.27