Is CVE-2026-53862 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53862 being exploited in the wild.

How severe is CVE-2026-53862?

Medium severity, with a CVSS score of 4.2, published 16 June 2026.

Which products and versions are affected?

openclaw (npm) SEMVER:introduced=0,fixed=2026.5.12; Openclaw < 2026.5.12, <= 2026.5.10-beta.2.

Is there a fix for CVE-2026-53862?

Yes. openclaw (npm): upgrade to 2026.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53862 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53862?

Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53862: OpenClaw bootstrap token replay in pending pairing scopes

Q: Is there a fix for CVE-2026-53862?

Yes. openclaw (npm): upgrade to 2026.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53862 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53862?

Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53862 · Severity: medium · CVSS 4.2 · Published 2026-06-16

OpenClaw, an AI assistant platform, contains a vulnerability in its device pairing process. An attacker with access to a temporary setup token could potentially reuse it to request broader access permissions than originally intended before the pairing is finalized. This could lead to an unauthorized expansion of access rights within the system, depending on how the administrator has configured the gateway.

Technologies: openclaw (npm), Openclaw. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-53862 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53862 being exploited in the wild.
How severe is CVE-2026-53862?: Medium severity, with a CVSS score of 4.2, published 16 June 2026.
Which products and versions are affected?: openclaw (npm) SEMVER:introduced=0,fixed=2026.5.12; Openclaw < 2026.5.12, <= 2026.5.10-beta.2.
Is there a fix for CVE-2026-53862?: Yes. openclaw (npm): upgrade to 2026.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53862 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53862?: Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openclaw (npm): upgrade to 2026.5.12 or later
```
npm install openclaw@2026.5.12
```

Technical details

A vulnerability in OpenClaw (npm package) allows for bootstrap token replay during the pairing process. In affected versions up to 2026.5.10-beta.2, a caller who possesses a pending bootstrap token can reuse that token to modify and broaden the requested scope set before the pairing is officially approved by an operator. This is classified as Improper Privilege Management (CWE-269). The attack requires network reachability and specific timing (before approval), with a CVSS complexity of High. The issue is resolved in version 2026.5.12.

Affected products

openclaw openclaw <= 2026.5.10-beta.2

Identifiers

CVE-2026-53862
GHSA-9v8j-9c9g-w66c

Timeline

2026-05-28: disclosed: Initial disclosure by reporter
2026-06-18: advisory: GitHub Advisory published
2026-05-12: patched: First stable patched version released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.