PT-2026-49025

CVE-2026-53821

Published

2026-06-12

Updated

2026-07-02

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.18

Description The software accepts WebSocket client-declared operator scopes before binding to a server-approved pairing or trusted-proxy authorization baseline. This allows unpaired or restricted trusted-proxy Control UI clients to obtain cached operator.admin authority on live WebSocket connections, enabling the execution of admin-gated Gateway RPCs.

Recommendations Update to version 2026.5.18.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

CWE-862: Missing Authorization

Related identifiers