CVE-2026-53862

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12

Description A bootstrap token replay issue allows callers with access to a pending bootstrap token to reuse it before approval with a broader requested scope. This can lead to the escalation of pairing authority beyond the intended scope limits. The impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

Recommendations Update to version 2026.5.12. Treat pairing codes as sensitive and cancel unexpected pending pairings. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the bootstrap token feature when it is not needed.