Medium severity4.2NVD Advisory· Published Jun 16, 2026· Updated Jun 16, 2026

CVE-2026-53862

Description

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.5.12	2026.5.12

Affected products

OpenClaw/Openclawllm-fuzzy
Range: < 2026.5.12

Patches

Vulnerability mechanics

References

News mentions

OpenClaw: 25 CVEs Disclosed in a Single Day — Allowlist Bypasses and Privilege Escalation Dominate
Vypr Intelligence · Jun 16, 2026

Severity

MediumCVSS v3.1

4.2/ 10

CVSS v42.3

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: High
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected

Source repo: github.com/openclaw/openclaw

EPSS

Probability of exploitation in the next 30 days.

0.09%

VYPR risk score

Composite of severity, exploitation, and reach.

0.20low

cvss	0.273
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-266
Incorrect Privilege Assignment
CWE-269
Improper Privilege Management
CWE-345
Insufficient Verification of Data Authenticity

CVE ID

CVE-2026-53862

Credits

Y
YLChen-007
reporter · ghsa