VYPR
← All advisories
High severity8.8NVD Advisory· Published Jun 16, 2026· Updated Jun 18, 2026

CVE-2026-53843

CVE-2026-53843

Description

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.5.262026.5.26

Affected products

5
  • OpenClaw/Openclawllm-fuzzy5 versions
    <2026.5.26+ 4 more
    • (no CPE)range: <2026.5.26
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.5.26
    • cpe:2.3:a:openclaw:openclaw:2026.5.26:beta1:*:*:*:node.js:*:*
    • cpe:2.3:a:openclaw:openclaw:2026.5.26:beta2:*:*:*:node.js:*:*
    • (no CPE)range: <2026.5.26

Patches

Vulnerability mechanics

References

4

News mentions

1