PT-2026-49779 · Openclaw · Openclaw

Edward-X · Publicado 2026-06-16 · Atualizado 2026-06-16 · CVE-2026-53862

Mitre

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.

Correção

Incorrect Privilege Assignment

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-266

CWE-345

Identificadores relacionados

CVE-2026-53862

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-9v8j-9c9g-w66c · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-bootstrap-token-replay-via-pending-pairing-scope-widening · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53862 · Nota de Segurança