Which versions of OpenClaw are affected by EUVD-2026-37145?

OpenClaw installations are vulnerable to an authorization bypass (CVE-2026-53843, CVSS 8.7) that defeats session revocation controls for paired devices.. A patch is available.

How to fix or mitigate EUVD-2026-37145?

Within 24 hours: Inventory all OpenClaw deployments and identify systems running versions before 2026.5.26; document which paired devices are configured and their access scope. Within 7 days: Implement compensating controls-apply network segmentation to restrict OpenClaw node access, disable non-essential device pairings, and deploy monitoring on WebSocket token generation and node access patterns. Within 30 days: Apply vendor patch (OpenClaw 2026.5.26 or later) immediately upon release and after change control testing.

OpenClaw EUVD-2026-37145

Q: What is the CVSS score of EUVD-2026-37145?

EUVD-2026-37145 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-53843 HIGH

Insufficient Session Expiration (CWE-613)

2026-06-16 VulnCheck

GHSA-q99w-vh6v-q3v7

GHSA-wrmq-9fc4-gwwj

Authentication Bypass Openclaw

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable WebSocket endpoint (AV:N/AC:L), but attacker must already control a paired device session (PR:L), no user interaction, and node-level access yields high C/I/A within the same node (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:55 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.

AnalysisAI

Authorization bypass in OpenClaw before 2026.5.26 allows an attacker with a previously paired device to re-establish WebSocket node-level authority after the session has been revoked, effectively defeating the revocation control. The flaw stems from a surviving pairing-scoped device session that can mint new node tokens without renewed approval, letting authenticated attackers retain unauthorized node-level access longer than intended. No public exploit identified at time of analysis, but the issue is acknowledged in a GitHub Security Advisory (GHSA-q99w-vh6v-q3v7) and a VulnCheck advisory.

Technical ContextAI

OpenClaw uses a pairing-and-token model in which a device is paired with a node and then issued scoped session tokens to authenticate WebSocket connections to node-level APIs. The vulnerability is a CWE-613 Insufficient Session Expiration issue: the pairing-scoped device session is not fully invalidated when a node token is revoked, so the still-trusted device session can be reused to obtain fresh node-level tokens. In effect, revocation acts only on the derived token rather than on the underlying pairing session that authorizes token issuance, breaking the trust-hierarchy assumption that revoking a token cuts off downstream access.

RemediationAI

Vendor-released patch: OpenClaw 2026.5.26 - upgrade to this version or later, per the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-q99w-vh6v-q3v7 and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-node-token-revocation-bypass-via-pairing-scoped-device-session. Until the upgrade is rolled out, operators should treat token revocation as insufficient on its own and additionally unpair the affected device at the pairing layer (removing the device pairing entry, not just revoking issued tokens), which forces a fresh approval flow but disrupts legitimate use of that device until re-pairing. As a network-layer compensating control, restrict WebSocket node endpoints to known management networks or mTLS-authenticated clients so that a still-trusted but suspect device cannot reach the node API path used to re-mint tokens; this adds operational overhead and may break remote management for legitimate paired devices that connect from outside the allowed network.