The vulnerability resides in OpenClaw nodes where the node.pair.approve function accepts an operator.write scope rather than the intended operator.pairing scope. Consequently, individuals who possess only operator.write privileges can trigger node pairing approval without higher authorization. This flaw allows attackers to initiate pairing with exec‑capable nodes, effectively granting them control over those nodes.

Affected systems are OpenClaw installations using versions earlier than 2026.4.8. The flaw exists across the core node.js implementation, as indicated by the CPE entry for the OpenClaw node.js component. Administrators should verify that their deployment is on a protected version; any deployment prior to 2026.4.8 is susceptible.

The CVSS score of 8.7 classifies the flaw as high severity. While no EPSS value is supplied, the absence of exploit data does not diminish risk, as the issue permits full authorization bypass and unlocks nodes that can execute commands. Attackers need only to hold an operator.write token—an access level that can be held by many users in the platform. Since the weakness has not been listed in CISA KEV and no public exploit code is known, the likely attack vector involves a legitimate but malicious use of the API by a compromised operator.write user. Administrators should treat this as a critical patch priority.