GHSA-553v-f69r-656j: OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth

March 3, 2026

A client using shared gateway auth could attach an unpaired device identity and request elevated operator scopes (including operator.admin) before pairing approval, enabling privilege escalation.

References

github.com/advisories/GHSA-553v-f69r-656j
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/8d1481cb4a9d31bd617e52dc8c392c35689d9dea
github.com/openclaw/openclaw/security/advisories/GHSA-553v-f69r-656j

Code Behaviors & Features

Detect and mitigate GHSA-553v-f69r-656j with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →