CVE-2026-28473: OpenClaw authorization bypass Operator.write Can Resolve Exec Approvals Vulnerability
HIGHCVE-2026-28473 is a HIGH (CVSS 7.2) operator.write can resolve exec approvals vulnerability (CWE-269: Improper Privilege Management) affecting OpenClaw authorization bypass libraries in the npm ecosystem. The issue involves operator.write can resolve exec approvals via chat.send -> /approve. Remediation is available by upgrading affected packages to version 2026.2.2.
CVE-2026-28473 at a Glance
Security Impact
CVSS: 7.2
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
How to Fix CVE-2026-28473
To remediate this vulnerability, upgrade all affected OpenClaw authorization bypass dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install openclaw@2026.2.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls openclawHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-28473, inspect your project dependencies using npm:
npm ls openclawAnalyze the terminal output to locate any version of OpenClaw authorization bypass in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2026.2.2), your application is affected.
Note: The npm ls openclaw command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-269: Improper Privilege Management, where the product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. In OpenClaw authorization bypass, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-28473 Affected OpenClaw authorization bypass Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
openclaw
|
npm |
< 2026.2.2
|
2026.2.2
|
References
Frequently Asked Questions
What is CVE-2026-28473?
Which OpenClaw authorization bypass versions are affected?
What version fixes CVE-2026-28473?
Is openclaw affected?
What is the CVSS score of CVE-2026-28473?
What CWE is associated with CVE-2026-28473?
How can I check npm dependencies for CVE-2026-28473?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-mqpw-46fh-299h",
"modified" : "2026-03-06T01:02:19Z",
"published" : "2026-02-17T21:39:11Z",
"aliases" : [ "CVE-2026-28473" ],
"summary" : "OpenClaw authorization bypass: operator.write can resolve exec approvals via chat.send -> /approve",
"details" : "## Summary\n\n### What this means (plain language)\n\nIf you give a client “chat/write” access to the gateway (`operator.write`) but you do not intend to let that client approve exec requests (`operator.approvals`), affected versions could still let that client approve/deny a pending exec approval by sending the `/approve` chat command.\n\nThis is mainly relevant for shared or multi-client setups where different tokens are intentionally scoped differently. Single-operator installs are typically less impacted.\n\n### Technical summary\n\nA gateway client authenticated with a device token scoped only to `operator.write` (without `operator.approvals`) could approve/deny pending exec approval requests by sending a chat message containing the built-in `/approve` command.\n\n`exec.approval.resolve` is correctly scoped to `operator.approvals` for direct RPC calls, but the `/approve` command path invoked it via an internal privileged gateway client.\n\n## Affected Packages / Versions\n\n- `openclaw` (npm): `< 2026.2.2`\n\n## Fix\n\n- Fixed in `openclaw` `2026.2.2`.\n- Fix commit(s): `efe2a464afcff55bb5a95b959e6bd9ec0fef086e`.\n- Change: when `/approve` is invoked from gateway clients (webchat/internal channel), it now requires the requesting client to have `operator.approvals` (or `operator.admin`).\n\n## Workarounds\n\n- Upgrade to `openclaw >= 2026.2.2`.\n- If you cannot upgrade: avoid issuing write-only device tokens to untrusted clients; disable text commands (`commands.text=false`) or restrict access to the webchat/control UI.\n\n## References\n\n- Fix: `src/auto-reply/reply/commands-approve.ts`\n- Coverage: `src/auto-reply/reply/commands-approve.test.ts`\n\n## Release Process Note\n\nThis advisory is kept in draft; once the fixed npm versions are available, it can be published without further edits.\n\nThanks @yueyueL for reporting.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "openclaw"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2026.2.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/security/advisories/GHSA-mqpw-46fh-299h"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28473"
}, {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/commit/efe2a464afcff55bb5a95b959e6bd9ec0fef086e"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/openclaw/openclaw"
}, {
"type" : "WEB",
"url" : "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-approve-chat-command"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-269", "CWE-863" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-02-17T21:39:11Z",
"nvd_published_at" : "2026-03-05T22:16:21Z"
}
}