CVE-2026-53852: OpenClaw scope containment bypass in device re-pairing

Executive brief

OpenClaw, a tool used for managing device gateways, contains a flaw in how it handles device re-pairing. An attacker could potentially bypass security restrictions to gain broader access permissions than intended. This could lead to unauthorized access to sensitive data or system functions depending on the specific configuration.

Technical details

A vulnerability exists in OpenClaw (npm package) where a device re-pairing request containing an empty scope set fails to trigger intended containment guards. This is a 'Failing Open' (CWE-636) issue where the system defaults to a less restrictive state when an empty scope is provided. An authenticated attacker with network access can exploit this during the re-pairing process to retain or restore scopes broader than those typically granted to the caller. The vulnerability is patched in version 2026.4.25.

Affected products

• openclaw openclaw <= 2026.4.24

Timeline

• 2026-05-28: disclosed
• 2026-06-18: advisory
• 2026.4.25: patched

References

• https://api.github.com/users/zsxsoft
• https://github.com/zsxsoft
• https://api.github.com/users/zsxsoft/gists%7B/gist_id%7D
• https://api.github.com/users/zsxsoft/repos
• https://avatars.githubusercontent.com/u/2398785?v=4
• https://api.github.com/users/zsxsoft/events%7B/privacy%7D