OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening
Priority LOW 11CWE-266Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-266 and CWE-345.
Summary
OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00088 0th percentileScored 2026-11-07
Fix Fixed OpenClaw (OpenClaw): 2026.5.12openclaw (npm): 2026.5.12
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenClaw | OpenClaw | before 2026.5.12 | 2026.5.12 | Patch available | CNA |
| — | openclaw (npm) | before 2026.5.12 | 2026.5.12 | Patch available | GHSA-9v8j-9c9g-w66c |
- OpenClaw VendorOpenClaw Affected before 2026.5.12 Fixed in 2026.5.12 Patch available CNA
- openclaw (npm) Vendor— Affected before 2026.5.12 Fixed in 2026.5.12 Patch available GHSA-9v8j-9c9g-w66c
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* | before 2026.5.12 | Vulnerable | OpenClaw |
| cpe:2.3:a:openclaw:openclaw:2026.5.12:beta1:*:*:*:node.js:*:* | 2026.5.12 beta1 | Vulnerable | OpenClaw |
| cpe:2.3:a:openclaw:openclaw:2026.5.12:beta2:*:*:*:node.js:*:* | 2026.5.12 beta2 | Vulnerable | OpenClaw |
| cpe:2.3:a:openclaw:openclaw:2026.5.12:beta3:*:*:*:node.js:*:* | 2026.5.12 beta3 | Vulnerable | OpenClaw |
| cpe:2.3:a:openclaw:openclaw:2026.5.12:beta4:*:*:*:node.js:*:* | 2026.5.12 beta4 | Vulnerable | OpenClaw |
| cpe:2.3:a:openclaw:openclaw:2026.5.12:beta5:*:*:*:node.js:*:* | 2026.5.12 beta5 | Vulnerable | OpenClaw |
| cpe:2.3:a:openclaw:openclaw:2026.5.12:beta6:*:*:*:node.js:*:* | 2026.5.12 beta6 | Vulnerable | OpenClaw |
| cpe:2.3:a:openclaw:openclaw:2026.5.12:beta7:*:*:*:node.js:*:* | 2026.5.12 beta7 | Vulnerable | OpenClaw |
| cpe:2.3:a:openclaw:openclaw:2026.5.12:beta8:*:*:*:node.js:*:* | 2026.5.12 beta8 | Vulnerable | OpenClaw |
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* Versions before 2026.5.12 Vulnerable ·OpenClaw
- cpe:2.3:a:openclaw:openclaw:2026.5.12:beta1:*:*:*:node.js:*:* Versions 2026.5.12 beta1 Vulnerable ·OpenClaw
- cpe:2.3:a:openclaw:openclaw:2026.5.12:beta2:*:*:*:node.js:*:* Versions 2026.5.12 beta2 Vulnerable ·OpenClaw
- cpe:2.3:a:openclaw:openclaw:2026.5.12:beta3:*:*:*:node.js:*:* Versions 2026.5.12 beta3 Vulnerable ·OpenClaw
- cpe:2.3:a:openclaw:openclaw:2026.5.12:beta4:*:*:*:node.js:*:* Versions 2026.5.12 beta4 Vulnerable ·OpenClaw
- cpe:2.3:a:openclaw:openclaw:2026.5.12:beta5:*:*:*:node.js:*:* Versions 2026.5.12 beta5 Vulnerable ·OpenClaw
- cpe:2.3:a:openclaw:openclaw:2026.5.12:beta6:*:*:*:node.js:*:* Versions 2026.5.12 beta6 Vulnerable ·OpenClaw
- cpe:2.3:a:openclaw:openclaw:2026.5.12:beta7:*:*:*:node.js:*:* Versions 2026.5.12 beta7 Vulnerable ·OpenClaw
- cpe:2.3:a:openclaw:openclaw:2026.5.12:beta8:*:*:*:node.js:*:* Versions 2026.5.12 beta8 Vulnerable ·OpenClaw
Remediation
- Fix · CNA OpenClaw (OpenClaw) Fixed in 2026.5.12
- Fix · GHSA-9v8j-9c9g-w66c openclaw (npm) Fixed in 2026.5.12 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
OpenClaw 2026.5.12
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-38862 OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command ParsingPriority LOW 35
- TI-2026-38849 OpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOSPriority LOW 35
- TI-2026-38847 OpenClaw < 2026.5.12 - Slack Reaction Event Notification BypassPriority LOW 33
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53862
- 2026-10-03 Alias added: GHSA-9v8j-9c9g-w66c
References
More Openclaw vulnerabilities
- TI-2026-25309 OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read CVSS 4.0HIGH 8.7
- TI-2026-20394 Exposure of resource to wrong sphere in OpenClaw CVSS 3.1HIGH 8.8
- TI-2026-27742 OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation CVSS 4.0HIGH 8.4
- TI-2026-27766 OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing CVSS 4.0MEDIUM 6.9
- TI-2026-07315 OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authentication CVSS 4.0MEDIUM 6.9
- TI-2026-17789 OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run CVSS 4.0HIGH 7.5
Sources
- CVE-2026-53862 · CVE Program
- CVE-2026-53862 · NVD
- FIRST EPSS
- GHSA-9v8j-9c9g-w66c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences