CVE-2026-53838CWE-367

OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnection

Medium · published June 12, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
29.6
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00369 · 29.6th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-06-12T21:57Z
EPSS history
Timeline
  • 12 JUN 21:57Z
    OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnection
    cvelistv5