by Kastro
Paper/Archive/CVE-2026-53838

CVE-2026-53838

OpenClaw OpenClaw — OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnection

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
32
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 13.8.138 × 202.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.5.272026.5.27CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)6.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-83w9-h5wv-j9xmwriteupvulncheck.com/advisories/openclaw-node-pairing-state-mutation-via-reconnection