Executive brief
OpenClaw, a tool used for managing device connections and gateway operations, contains a flaw in how it handles device re-pairing. An authorized user could bypass security restrictions to gain broader access to a device than they are supposed to have. This could lead to unauthorized data access or the retention of elevated permissions that should have been restricted.
Technical details
A vulnerability in OpenClaw before version 2026.4.25 allows authenticated operators to bypass scope containment guards during device re-pairing. The root cause is a 'fail open' condition (CWE-636) where submitting a re-pairing request with an empty scope set causes the system to skip intended security checks. By exploiting this, an attacker with low-level network privileges can restore or retain broader access scopes than the caller is authorized to grant. This issue is resolved in version 2026.4.25; users are advised to upgrade and revoke any suspicious device sessions.
Affected products
- OpenClaw openclaw < 2026.4.25
Timeline
- 2026-05-28: advisory: Original advisory GHSA-8mg9-j9cf-54cj published
- 2026-06-16: disclosed: CVE-2026-53852 published
- 2026-06-18: patched: Duplicate advisory withdrawn and patch version confirmed