CVE-2026-53862: Openclaw Privilege Escalation Vulnerability

CVE-2026-53862 Overview

CVE-2026-53862 is a bootstrap token replay vulnerability in OpenClaw versions prior to 2026.5.12. Callers with access to pending tokens can replay them with broader requested scopes before approval, escalating pairing authority beyond intended scope limits. The flaw is categorized under [CWE-266: Incorrect Privilege Assignment] and affects the OpenClaw Node.js package. Exploitation requires network access, high attack complexity, and user interaction. The vendor addressed the issue in release 2026.5.12.

Critical Impact
Attackers can replay bootstrap tokens during the pending-approval window to widen pairing scopes, gaining authority beyond what the original request intended.

Affected Products

OpenClaw (Node.js package) versions before 2026.5.12
OpenClaw 2026.5.12 beta1 through beta8 prereleases
Deployments relying on bootstrap token pairing for device or service enrollment

Discovery Timeline

2026-06-16 - CVE-2026-53862 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53862

Vulnerability Analysis

The vulnerability resides in OpenClaw's pairing workflow, which issues bootstrap tokens to bind new callers into an existing trust relationship. Tokens enter a pending state until an authorized approver confirms the requested scope. The pairing logic fails to bind the issued token to the original scope set requested at issuance time. A caller who already holds a pending token can resubmit it alongside a broader scope claim before approval completes. The server treats the replayed request as a continuation of the pending pairing and honors the widened scope at confirmation. This allows the requester to acquire pairing authority over resources never authorized by the approver.

Root Cause

The defect is an incorrect privilege assignment in the pending-token state machine. Scope values supplied at approval time are trusted instead of being validated against the immutable scope recorded when the token was first minted. Because scopes are not cryptographically bound to the bootstrap token, replays with modified scope parameters bypass the intended authorization boundary.

Attack Vector

An attacker must already possess a pending bootstrap token, hold network reachability to the OpenClaw endpoint, and rely on an approver completing the pairing. The attacker replays the token through the pairing channel with broader scope fields than originally requested. When the approver finalizes the operation, the wider scope is granted. Refer to the VulnCheck Advisory and the GitHub Security Advisory for full technical context. No public proof-of-concept code is available, and the EPSS probability is 0.087%.

Detection Methods for CVE-2026-53862

Indicators of Compromise

Repeated pairing requests reusing the same bootstrap token identifier from a single caller within a short window.
Pairing approvals where the granted scope set is larger than the scope recorded at token issuance.
Audit log entries showing scope field mutations between token mint and approval events.

Detection Strategies

Correlate bootstrap token issuance, replay, and approval events to identify scope drift across the token lifecycle.
Alert on any pairing confirmation whose final scope does not equal the originally requested scope.
Track callers that submit multiple pending-pairing operations referencing identical token material.

Monitoring Recommendations

Enable verbose audit logging for the OpenClaw pairing and approval endpoints.
Forward pairing telemetry to a centralized log platform and retain at least 90 days for retrospective review.
Review approver dashboards for unusual scope-elevation patterns during enrollment cycles.

How to Mitigate CVE-2026-53862

Immediate Actions Required

Upgrade OpenClaw to version 2026.5.12 or later, including replacing any 2026.5.12 beta builds.
Invalidate outstanding pending bootstrap tokens issued by vulnerable versions before upgrading.
Audit recent pairings for scope discrepancies and revoke any pairings that show unauthorized scope widening.

Patch Information

The vendor fix is delivered in OpenClaw 2026.5.12. Patch and remediation details are published in the GitHub Security Advisory GHSA-9v8j-9c9g-w66c. Update through the standard Node.js package manager and verify the installed version against the advisory.

Workarounds

Restrict who may initiate pairing operations until the upgrade is applied.
Require approvers to manually compare requested versus final scope before confirming any pending pairing.
Shorten the pending-token validity window to reduce the replay opportunity.

bash

# Update OpenClaw to the patched release
npm install openclaw@2026.5.12
npm ls openclaw