Executive brief
OpenClaw is a Node.js package that manages device pairing and authentication in gateway deployments. A flaw allows a previously-paired device to regain access to node-level operations even after its authorization token has been revoked, as long as the device maintains an active pairing session. This weakens the revocation control and can keep unauthorized access alive longer than intended.
Technical details
The vulnerability is an authorization bypass (CWE-284, CWE-863) affecting OpenClaw versions before 2026.5.26. A pairing-scoped device session can re-establish node token authority after revocation by exploiting the failure to properly terminate session privileges when a token is revoked. The attack requires an already-paired device with an active session; no unauthenticated access is possible. An attacker with a previously-legitimate pairing can regain WebSocket-level access to node operations without renewed approval. The patch is available in version 2026.5.26 and later; mitigations include restarting the gateway and re-pairing affected devices.
Affected products
- OpenClaw openclaw < 2026.5.26
Timeline
- 2026-05-28: disclosed
- 2026-05-26: patched: Version 2026.5.26 patches the vulnerability
- 2026-06-16: advisory: GHSA-wrmq-9fc4-gwwj published (later withdrawn as duplicate)
- 2026-06-18: other: Advisory withdrawn; duplicate of GHSA-q99w-vh6v-q3v7