PT-2026-49028 · Openclaw · Openclaw

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-53824

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-53824

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-4m3v-q747-pc6h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53824 · Security Note
• https://vulncheck.com/advisories/mattermost-slash-token-revocation-lag-via-monitor-refresh-delay · Note