PT-2026-32309
تاريخ النشر
2026-04-03
·
تاريخ التحديث
2026-04-03
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
Current Maintainer Triage
- Status: narrow
- Normalized severity: high
- Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
a77928b1087e90f2a8903f8e5aca6dec9237ac62— 2026-03-30T14:22:15+01:00
OpenClaw thanks @AntAISecurityLab for reporting.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾