Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.8, published 16 June 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-06-18: Duplicate advisory withdrawn and patch confirmed in 2026.5.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

OpenClaw authorization bypass via pairing-scoped device session

Severity: high · CVSS 8.8 · Published 2026-06-16

OpenClaw, an open-source communication library, contains a flaw that allows previously authorized devices to maintain access even after their permissions have been revoked. An attacker with an existing paired device can bypass security controls to regain full access to the system's communication channels without needing new approval from an administrator. This undermines the ability of operators to effectively kick unauthorized or compromised devices off the network.

Technologies: Openclaw. Vendors: Openclaw.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.8, published 16 June 2026.
Which products and versions are affected?: Openclaw < 2026.5.26.
Is there a fix for This vulnerability?: A patch was published on 2026-06-18: Duplicate advisory withdrawn and patch confirmed in 2026.5.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

OpenClaw before version 2026.5.26 is vulnerable to an authorization bypass (CWE-613/CWE-863) due to insufficient session expiration. When a node token is revoked, the system fails to invalidate associated pairing-scoped device sessions. An attacker with a previously paired device can leverage these surviving sessions to re-authenticate and regain WebSocket node-level access without renewed administrative approval. This allows for persistent unauthorized access and bypasses intended device-role containment. The issue is resolved in version 2026.5.26; as a manual mitigation for older versions, administrators should restart the gateway and manually re-pair devices.

Affected products

OpenClaw openclaw < 2026.5.26

Timeline

2026-05-28: advisory: Original advisory GHSA-q99w-vh6v-q3v7 published
2026-06-16: disclosed: CVE-2026-53843 published to NVD
2026-06-18: patched: Duplicate advisory withdrawn and patch confirmed in 2026.5.26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.