CVE-2026-28473
CVE-2026-28473 · OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the /approve chat command. The /approve command path invokes exec.approval.resolve through an internal privileged gateway client, bypassing the operator.approvals permission check that protects direct RPC calls.
CVSS 7.2 · Élevée · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node