PT-2026-49779 · Openclaw · Openclaw

Edward-X · CVE-2026-53862 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12

Description A bootstrap token replay issue allows callers with access to a pending bootstrap token to reuse it before approval with a broader requested scope. This can lead to the escalation of pairing authority beyond the intended scope limits. The impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

Recommendations Update to version 2026.5.12. Treat pairing codes as sensitive and cancel unexpected pending pairings. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the bootstrap token feature when it is not needed.

Exploit

Fix

Improper Privilege Management

Insufficient Verification of Data Authenticity

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-345

CWE-266

Related Identifiers

CVE-2026-53862

GHSA-9V8J-9C9G-W66C

GHSA-H9H6-PWQV-J9HV

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53862.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9v8j-9c9g-w66c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9v8j-9c9g-w66c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h9h6-pwqv-j9hv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53862 · Security Note
• https://osv.dev/vulnerability/CVE-2026-53862 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-bootstrap-token-replay-via-pending-pairing-scope-widening · Note
• https://t.me/cveNotify/168766 · Telegram Post
• https://t.me/cveNotify/170119 · Telegram Post