PT-2026-32309
Publicado
2026-04-03
·
Atualizado
2026-04-03
Descrição por
CVSS 3.1
8.8
AltaMétricasAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
Current Maintainer Triage
- Status: narrow
- Normalized severity: high
- Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
a77928b1087e90f2a8903f8e5aca6dec9237ac62— 2026-03-30T14:22:15+01:00
OpenClaw thanks @AntAISecurityLab for reporting.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Identificadores relacionados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾