Threats tagged 'ghsa-chr9-m4q2-76hw'

A vulnerability in OpenClaw CLI's Control UI allows an attacker with network access to spoof locality information during pairing, potentially obtaining a durable admin device token. This issue affects LAN/shared-token deployments where locality signals are trusted for pairing decisions. The vulnerability enables persistence of admin access even after shared tokens are rotated unless the paired device is removed. It is not exploitable remotely without prior network/authentication access. A fix is available in version 2026.5.22.