PT-2026-48747 · Openclaw · Openclaw

Cantinagen

·

CVE-2026-53817

·

Published

2026-06-11

·

Updated

2026-07-02

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.22
Description An issue in the Control UI pairing process involves insufficient locality-derived trust validation. This allows attackers with network access to spoof locality information to convert temporary shared access into persistent administrative credentials. These durable admin-capable device tokens remain valid even after token rotation.
Recommendations Update to version 2026.5.22.

Exploit

Fix

Authentication Bypass by Spoofing

Improper Access Control

Incorrect Authorization

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-290CWE-284CWE-863CWE-287

Related Identifiers

CVE-2026-53817
GHSA-CHR9-M4Q2-76HW

Affected Products

Openclaw