GHSA-xr4f-mjxj-w6w5: OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

The /pair command of the device-pair plugin issues a setup code that enrolls a new device. It was reachable through ordinary chat commands in channels such as Telegram, Discord or Slack. In affected releases the command did not require owner, admin or pairing scope, only that the sender was allowed to send commands to the agent.

The attacker is not anonymous. They must already be an authorized sender in a configured chat channel, which in a shared channel can be any member. They run /pair, get a setup code, and use it before it expires to enroll a device that holds operator and node capabilities. That device keeps persistent credentials until someone removes it, so access outlives the chat session and survives changes to the shared gateway token.

The result is a path from chat access to operator-level control of the gateway and its nodes. The advisory gives no code lifetime. Teams that share one agent among several chat users are the most exposed.

The npm package openclaw before 2026.5.4, with the bundled device-pair plugin enabled and at least one non-owner sender authorized to use normal chat commands in a channel such as Telegram, Discord or Slack.

npm ls openclaw

Use npm ls -g openclaw for a global install. Anything below 2026.5.4 is affected.

Upgrade to [email protected] or later, the first stable patched version:

npm install [email protected]

After upgrading, review paired devices and remove any you do not recognize, since a device enrolled through this flaw keeps its credentials. In shared chat channels, limit command access to users who should be allowed to manage device pairing. The advisory does not say how to list paired devices, so check the OpenClaw documentation for your version.

Look in chat history for /pair messages from senders who are not owners or admins. Review the list of paired devices for entries you did not set up, especially ones with operator or node capabilities that appeared at the time of such messages. The advisory gives no log string. Remove unexpected devices and rotate any secrets those devices could reach.

Summary

The bundled device-pair plugin exposed /pair on normal chat command surfaces. In affected releases, authorized non-owner chat senders could issue device-pairing bootstrap codes without having owner, admin, or pairing scope.

This issue does not affect unauthenticated users. The caller must already be allowed to send commands to the agent through a configured chat channel.

Affected configurations

This affects deployments where the bundled device-pair plugin is enabled and a non-owner sender is authorized to use normal chat commands, such as in a configured Telegram, Discord, or Slack agent.

Impact

A non-owner authorized sender could create a setup code and use it before expiry to enroll a device with operator/node capabilities. That device would then retain persistent credentials until removed.

Patched Versions

The first stable patched version is 2026.5.4.

Mitigations

Upgrade to [email protected] or later. Review paired devices and remove any unexpected entries. In shared chat channels, keep command access limited to users who should be allowed to manage device pairing.