Openclaw cli: OpenClaw: Empty-scope device re-pairing could confuse caller scope containment (CVE-2026-53852)

CVE-2026-53852 describes a vulnerability in openclaw-cli where device re-pairing requests with an empty scope set can skip the intended containment guard, potentially confusing caller scope containment. This flaw allows the restoration or retention of broader scopes than the caller should grant. The issue is limited to the named feature and configuration and does not alter the trusted-operator model of OpenClaw. The vulnerability is present in versions >=2026.1.29 and <2026.4.25. The first stable patched version is 2026.4.25.

The vulnerability can lead to broader access scopes being granted during device re-pairing than intended, which may allow an operator or device to retain or restore permissions beyond their authorized scope. The practical impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable code path. There is no indication of active exploitation in the wild.

A patch is available in openclaw-cli version 2026.4.25. Operators should upgrade to this version to remediate the vulnerability. Until patched, it is recommended to revoke unexpected device sessions and require fresh pairing for suspicious devices. Additional mitigations include keeping channel and tool allowlists narrow, avoiding sharing a Gateway between mutually untrusted users, and disabling the affected feature when it is not needed.