Openclaw cli: OpenClaw: Node pairing reconnection could confuse approval scope state (CVE-2026-53838)
Description
A vulnerability in OpenClaw CLI allows node pairing reconnection to confuse the approval scope state, potentially broadening node authority beyond operator intent. This affects versions from 2026.1.29 up to but not including 2026.5.28. The issue arises when a paired or reconnecting node session mutates pairing state, impacting approval scope decisions. The vulnerability does not alter the trusted-operator model but can present increased authority if the affected feature is enabled and reachable. A fix is available starting with version 2026.5.27. Operators are advised to revoke unexpected node pairings and re-pair only trusted nodes until patched, and to harden configurations by narrowing allowlists and disabling the feature if not needed.
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53838 describes a vulnerability in OpenClaw CLI where node pairing reconnection can mutate the pairing state, confusing the approval scope decision. This can lead to a broader node authority than intended by the operator when the affected feature is enabled and accessible. The vulnerability is scoped to the node pairing feature and does not compromise the overall trusted-operator model. The first stable patched version is 2026.5.27, addressing this issue. Mitigations include revoking unexpected node pairings, re-pairing trusted nodes, narrowing channel and tool allowlists, avoiding shared Gateways between untrusted users, and disabling the feature if unnecessary.
Potential Impact
If exploited, this vulnerability could allow an attacker to restore or gain broader node authority than intended by the operator, potentially leading to unauthorized actions within the OpenClaw environment. The actual impact depends on the operator's configuration and whether lower-trust inputs can reach the vulnerable feature. The CVSS score of 9.8 indicates critical severity with high confidentiality, integrity, and availability impacts.
Mitigation Recommendations
A patch is available starting with OpenClaw CLI version 2026.5.27. Operators should upgrade to this version to remediate the vulnerability. Until patched, revoke any unexpected node pairings and re-pair only trusted nodes. Additionally, narrow channel and tool allowlists, avoid sharing a Gateway between mutually untrusted users, and disable the affected node pairing feature if it is not needed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-53838
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2458c12601ec6a3164130
Added to database: 10/04/2026, 12:24:44 UTC
Last enriched: 10/04/2026, 12:36:37 UTC
Last updated: 10/04/2026, 16:08:39 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.