Which versions of OpenClaw are affected by CVE-2026-53821?

OpenClaw versions before 2026.5.18 contain a privilege escalation vulnerability enabling WebSocket-connected users to gain unauthorized administrator access; while no public exploit has been…. A patch is available.

How to fix or mitigate CVE-2026-53821?

Within 24 hours: Implement network segmentation to restrict WebSocket access to trusted sources, enable enhanced logging of WebSocket authentication/authorization events, and document all OpenClaw deployments. Within 7 days: Complete risk assessment of all WebSocket-connected Control UI clients, implement additional authentication barriers at network perimeter if feasible, and reduce privileged account surface area. Within 30 days: Monitor vendor advisories daily for patch availability, develop incident response procedures for privilege escalation attempts, and prepare deployment procedures for when patches become available.

OpenClaw CVE-2026-53821

Q: What is the CVSS score of CVE-2026-53821?

CVE-2026-53821 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36609 HIGH

Missing Authorization (CWE-862)

2026-06-12 VulnCheck

GHSA-vcg8-6gf2-cg9j

Authentication Bypass Openclaw

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable WebSocket, low complexity, requires a low-privileged Control UI client session (PR:L), no user interaction, full C/I/A impact on the OpenClaw instance with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 13, 2026 - 02:00 EUVD

Analysis Generated

Jun 12, 2026 - 22:30 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execute admin-gated Gateway RPCs.

AnalysisAI

Privilege escalation in OpenClaw before 2026.5.18 allows WebSocket-connected Control UI clients to claim operator.admin scope without server-side validation against pairing or trusted-proxy authorization state. Attackers with low-privileged WebSocket access can invoke admin-gated Gateway RPCs, and no public exploit identified at time of analysis despite CVSS 4.0 score of 8.7.

Technical ContextAI

OpenClaw exposes a Gateway with admin-gated RPCs reached over WebSocket by Control UI clients. The flaw is a CWE-862 Missing Authorization: the server accepts operator-scope claims declared by the client during the WebSocket session and caches them as authority, instead of cross-checking each request against the server-approved pairing record and the trusted-proxy authorization baseline. Per the CPE 'cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*', all OpenClaw application versions prior to 2026.5.18 are affected. Because authorization state is bound to the live WebSocket connection rather than re-derived from server-side trust, an unpaired or restricted client retains elevated 'operator.admin' authority for the lifetime of the socket.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.18 or later as described in GHSA-qjpc-qf9m-xwmr (https://github.com/openclaw/openclaw/security/advisories/GHSA-qjpc-qf9m-xwmr) and the VulnCheck write-up at https://www.vulncheck.com/advisories/openclaw-scope-elevation-in-trusted-proxy-control-ui-websocket. If immediate patching is not possible, restrict network exposure of the Control UI WebSocket endpoint to trusted management networks or a VPN (trade-off: blocks legitimate remote operators), and require pairing and trusted-proxy enrollment before any WebSocket session is accepted by terminating connections from unpaired clients at the reverse proxy (trade-off: may break provisioning workflows that rely on first-connect pairing). As an additional compensating control, disable or block admin-gated Gateway RPC routes for clients whose pairing or trusted-proxy state is not server-confirmed, accepting that this reduces functionality for legitimately restricted operators until upgrade.