The vulnerability allows a paired device to circumvent the node scope gate authentication in OpenClaw before 2026.3.31, enabling remote execution of arbitrary node commands on the host system. The flaw is a privilege escalation/authorization bypass flaw (CWE‑862) that can compromise confidentiality, integrity, and availability if the attacker can pair a device. The impact extends across any system running the vulnerable software, with direct control over node processes.

All installations of OpenClaw older than version 2026.3.31 are affected. The vulnerability is present in the OpenClaw product (OpenClaw:OpenClaw) before the 2026.3.31 release, regardless of the operating system or node.js version, as the node scope gate bypass applies to the core application layer.

The CVSS score of 7.7 indicates high risk, but the EPSS score of less than 1% implies that current exploitation likelihood is low. The vulnerability is not listed in CISA KEV, so no public exploit has been confirmed yet. Attackers would need valid device pairing credentials to reach the node, and would accomplish exploitation remotely by sending specially crafted commands that bypass the gate. Users with exposed device pairing interfaces or insufficient validation should prioritize remediation.