Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

OpenClaw: New Account Pairing Requests Can Be Blocked

published 6 months ago
Summary

Using OpenClaw version 2026.2.26 to 2026.3.30, a technical limitation could prevent one account from pairing with another until an existing pairing request is approved or expires. This is not a security risk, but it may inconvenience users. To avoid this issue, update to OpenClaw version 2026.3.31 or later.

What to do
  • Update steipete openclaw to version 2026.3.31.
  • Update GitHub Actions openclaw to version 2026.3.31.
  • Update openclaw openclaw to version 2026.3.31 or later.
Affected software
Ecosystem VendorProductAffected versions
npm steipete openclaw >= 2026.2.26, < 2026.3.31
Fix: upgrade to 2026.3.31
– openclaw openclaw >= 2026.2.26, < 2026.3.31
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
npm GitHub Actions openclaw >= 2026.2.26, < 2026.3.31
Fix: upgrade to 2026.3.31
Original advisory text
OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can subm...
OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts, causing denial of service.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-799Improper Control of Interaction Frequency
Timeline
Published23 Apr 2026
Updated7 May 2026
First seen7 Apr 2026
Sources
GHSA-wwfp-w96m-c6x8 · OSV
Track software like this
Free during beta