Is there a patch available for CVE-2026-53838?

Yes, a patch is available for CVE-2026-53838. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-53838

Q: What is the CVSS score of CVE-2026-53838?

CVE-2026-53838 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36626 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-06-12 VulnCheck

GHSA-c85p-9pvr-f7f5

Authentication Bypass Openclaw

6.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

TOCTOU state confusion requires specific reconnection timing (AC:H); attacker must be a pre-authorized paired node (PR:L); integrity-only impact with no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 13, 2026 - 02:00 EUVD

Analysis Generated

Jun 12, 2026 - 22:46 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.27.

DescriptionCVE.org

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions.

AnalysisAI

State mutation in OpenClaw's node pairing reconnection logic allows a low-privilege paired node to escalate its effective authority by confusing the approval scope engine, potentially bypassing access restrictions within the system. Affected versions are all OpenClaw releases before 2026.5.27, as identified by CPE cpe:2.3:a:openclaw:openclaw. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the integrity impact is rated High given an attacker can restore or inflate node authority beyond what was originally sanctioned.

Technical ContextAI

OpenClaw is a system that supports node-to-node pairing with scoped approval authority, where each paired node is granted specific permissions during the initial authorization handshake. The vulnerability lies in the reconnection workflow: when a previously paired node reconnects, the system evaluates the node's approval scope at one point in time (the check) but applies that scope after the state has been allowed to mutate (the use), producing a classic CWE-367 Time-of-Check Time-of-Use (TOCTOU) race/state-confusion condition. Because the reconnection path does not atomically re-validate or consistently freeze the node's authorized scope, a malicious node can engineer the state transition so that it presents - and is accepted as having - a broader scope than was originally granted. The CVSS 4.0 vector uses AT:P (Attack Requirements: Present), confirming the attack depends on specific deployment conditions - namely, that node pairing and reconnection are active features of the target deployment.

RemediationAI

Upgrade to OpenClaw version 2026.5.27 or later, which resolves the state mutation in the node pairing reconnection path per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-83w9-h5wv-j9xm. If immediate upgrade is not feasible, administrators should consider disabling node reconnection functionality if the feature is not operationally required, as this removes the exploitable code path entirely - the trade-off is that nodes will require manual re-pairing after network interruptions. Restricting which nodes are permitted to initiate reconnection (e.g., via network-layer allowlisting or node authentication enforcement at the perimeter) can reduce exposure but does not eliminate the underlying flaw. Additional context from the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-node-pairing-state-mutation-via-reconnection may provide further operational guidance.