[openclaw] OpenClaw: Node exec approvals could be replayed across nodes

**[openclaw] OpenClaw: Node exec approvals could be replayed across nodes**

Summary exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet. Impact An operator approval for a system.run request could be reused across nodes if the request payload did not carry node identity through approval and execution checks. Affected Packages / Versions Package: openclaw (npm) Affected: <= 2026.2.22-2 Fixed: 2026.2.23 (released) Mitigation Upgrade to 2026.2.23 or later once published. Fix Details The fix requires and persists nodeId for host=node approval requests and rejects execution when the approving node binding does not match the invoking node. Fix Commit(s) 4a3f8438e527ac371a67fe7ac68a287f0dbe6063 Release Process Note patched_versions is pre-set to the released version (2026.2.23)...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.