Openclaw cli: OpenClaw: Pairing-scoped device session could restore revoked node token authority (CVE-2026-53843)
Description
A vulnerability in openclaw-cli allows a device with a surviving pairing-scoped session to regain node token authority after that token has been revoked. This undermines the intended revocation mechanism, potentially allowing continued node-level access without renewed approval. The issue affects devices that already had legitimate pairing and session footholds. The vulnerability is patched in openclaw-cli version 2026.5.26 and later.
CVSS v3.1
Score 8.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In openclaw-cli versions from 2026.1.29 up to but not including 2026.5.28, a pairing-scoped device session could restore node token authority even after the node token was revoked. Normally, revocation should remove this authority unless the device is re-approved through the pairing process. This flaw weakens operator control over token revocation and device-role containment but does not permit unauthenticated device creation. The vulnerability impacts only devices with an existing legitimate pairing/session foothold.
Potential Impact
Devices that should lose node WebSocket authority upon token revocation may regain it without renewed approval, weakening the revocation control and potentially allowing node-level access to persist longer than intended. The impact is limited to devices already paired and holding a session with pairing-related scope.
Mitigation Recommendations
Upgrade to openclaw-cli version 2026.5.26 or later. For devices with revoked node tokens on older versions, restart the gateway and remove and re-pair the affected device to ensure no stale sessions remain active.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-53843
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2458c12601ec6a316412b
Added to database: 10/04/2026, 12:24:44 UTC
Last enriched: 10/04/2026, 12:36:05 UTC
Last updated: 10/04/2026, 16:08:39 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.