Search: CVE-2026-53838

A vulnerability in OpenClaw CLI allows node pairing reconnection to confuse the approval scope state, potentially broadening node authority beyond operator intent. This affects versions from 2026.1.29 up to but not including 2026.5.28. The issue arises when a paired or reconnecting node session mutates pairing state, impacting approval scope decisions. The vulnerability does not alter the trusted-operator model but can present increased authority if the affected feature is enabled and reachable. A fix is available starting with version 2026.5.27. Operators are advised to revoke unexpected node pairings and re-pair only trusted nodes until patched, and to harden configurations by narrowing allowlists and disabling the feature if not needed.