medium4.2
CVE-2026-53862
OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested sco…
Impact
OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openclaw | <= 2026.5.10-beta.2 | 2026.5.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openclaw | Openclaw | before 2026.5.12 Version 2026.5.12 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-9v8j-9c9g-w66c
- https://github.com/openclaw/openclaw/security/advisories/GHSA-9v8j-9c9g-w66c
- https://nvd.nist.gov/vuln/detail/CVE-2026-53862
- https://www.vulncheck.com/advisories/openclaw-bootstrap-token-replay-via-pending-pairing-scope-widening