npm/openclaw CVE-2026-32922: critical 9.9, EPSS 0.69%

OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE

Action: Upgrade openclaw to 2026.3.11 or later.

npm i openclaw@2026.3.11

Affected

Fixed versions

Sources

• osv: GHSA-4jpw-hj22-2xmc
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4jpw-hj22-2xmc
• https://github.com/openclaw/openclaw
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.11

CVE-2026-32922 · published 2026-03-13T15:47:29Z · modified 2026-07-08T07:35:46.897913895Z · JSON