Root cause
Authentication & access control introduced
The AI-assisted change below is where the vulnerable behavior appears.
An AI-assisted trusted-proxy exception let fresh, unapproved Control UI devices retain client-requested scopes before server-side pairing approved them. The original device-less path cleared scopes and must be distinguished from the fresh-device path. Trusted-proxy authentication alone did not establish device privilege. An initial clamp removed unapproved scopes, a later change reintroduced the exception, and a subsequent pairing repair closed that recurrence. Source and published package provenance support discontinuous affected windows, without certifying every historical package or attributing the recurrence to AI.
How AI contributed: Direct introductionPublished Jul 2, 2026 in 
openclaw/openclawAll 35 findings in this repository
Provisional finding. Full causal and release verification remains incomplete.
What actually happenedHide details
An AI-assisted trusted-proxy exception let fresh, unapproved Control UI devices retain client-requested scopes before server-side pairing approved them. The original device-less path cleared scopes and must be distinguished from the fresh-device path. Trusted-proxy authentication alone did not establish device privilege.
Fix
fix
An initial clamp removed unapproved scopes, a later change reintroduced the exception, and a subsequent pairing repair closed that recurrence. Source and published package provenance support discontinuous affected windows, without certifying every historical package or attributing the recurrence to AI.
Case facts
- GHSA ID
- GHSA-QJPC-QF9M-XWMR
- Published
- Jul 2, 2026
- Severity
- Not scored
- Language
- TypeScript
- AI tool
Cursor- AI role
- Direct introduction
- Vulnerable release
- >=2026.2.24 <2026.5.4; >=2026.5.12 <2026.5.18
- Fixed release
- v2026.5.18
AI-assisted change
AI-assisted changesrc/gateway/server/ws-connection/connect-policy.tssource openclaw/openclaw@20523b918a+4−0
@@ -35,7 +35,11 @@ export function shouldSkipControlUiPairing( policy: ControlUiAuthPolicy, sharedAuthOk: boolean,+ trustedProxyAuthOk = false, ): boolean {+ if (trustedProxyAuthOk) {+ return true;+ } return policy.allowBypass && sharedAuthOk;Show 2 hidden lines
} Successful trusted-proxy authentication bypasses the pairing decision, separating authentication from server approval of device privileges.
Security fix
Fixsrc/gateway/server/ws-connection/message-handler.tssource openclaw/openclaw@a8d1bd6fe1+4−0
@@ -1133,8 +1136,12 @@ if (!ok) { return; }+ hasServerApprovedDeviceTokenBaseline = true;+ } else if (trustedProxyAuthOk) {+ clearUnboundScopes(); } } else {+ hasServerApprovedDeviceTokenBaseline = true;Show 3 hidden lines
const claimedPlatform = connectParams.client.platform; const pairedPlatform = paired.platform; const claimedDeviceFamily = connectParams.client.deviceFamily;The first closing change clears requested scopes for an unapproved trusted-proxy device rather than trusting its requested privileges.
Fixsrc/gateway/server/ws-connection/message-handler.tssource openclaw/openclaw@a8d1bd6fe1+4−3
@@ -1222,9 +1229,10 @@ } } - const deviceToken = device- ? await ensureDeviceToken({ deviceId: device.id, role, scopes })- : null;+ const deviceToken =Show 6 hidden lines
+ device && hasServerApprovedDeviceTokenBaseline+ ? await ensureDeviceToken({ deviceId: device.id, role, scopes })+ : null; const bootstrapDeviceTokens: Array<{ deviceToken: string; role: string;Device-token issuance now requires a server-approved device baseline.
Patch fingerprints
AI-assisted change 72c3c50a58cf0469edfc77ba7426cb34e6af6211db2164e37b1fc090e6508ab6 · Fix 1dbf66727a82cebd9a0e0600b0231f263de98ade9cb4661c6d622f74a5a19282