Change History
4 change records found show changes
CVE Modified by VulnCheck 4/06/2026 7:16:26 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V4.0 |
|
AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| Removed |
CVSS V4.0 |
AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
|
| Added |
CVSS V3.1 |
|
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
|
| Removed |
CVSS V3.1 |
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
|
Initial Analysis by NIST 4/01/2026 3:07:04 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CPE Configuration |
|
OR
*cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* versions up to (excluding) 2026.3.28
|
| Added |
Reference Type |
|
VulnCheck: https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd Types: Patch
|
| Added |
Reference Type |
|
VulnCheck: https://github.com/openclaw/openclaw/security/advisories/GHSA-hc5h-pmr3-3497 Types: Vendor Advisory
|
| Added |
Reference Type |
|
VulnCheck: https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-missing-caller-scope-validation-in-device-pair-approval Types: Third Party Advisory
|
CVE Modified by VulnCheck 3/31/2026 2:16:54 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3.1 |
|
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
| Removed |
CVSS V3.1 |
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
New CVE Received from VulnCheck 3/31/2026 11:16:14 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Description |
|
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.
|
| Added |
CVSS V4.0 |
|
AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| Added |
CVSS V3.1 |
|
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| Added |
CWE |
|
CWE-863
|
| Added |
Reference |
|
https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd
|
| Added |
Reference |
|
https://github.com/openclaw/openclaw/security/advisories/GHSA-hc5h-pmr3-3497
|
| Added |
Reference |
|
https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-missing-caller-scope-validation-in-device-pair-approval
|