Is there a public PoC exploit available for EUVD-2026-37154?

Yes, a public proof-of-concept exploit is available for EUVD-2026-37154. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-37154?

Yes, a patch is available for EUVD-2026-37154. Update the affected software to the latest version immediately.

OpenClaw EUVD-2026-37154

Q: What is the CVSS score of EUVD-2026-37154?

EUVD-2026-37154 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-53852 LOW

Not Failing Securely ('Failing Open') (CWE-636)

2026-06-16 VulnCheck

GHSA-8mg9-j9cf-54cj

GHSA-hc4w-hm59-9w88

Authentication Bypass Openclaw

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

Network-accessible by low-privileged operators (PR:L), but the AT:P re-pairing state prerequisite maps to AC:H; no availability or cross-system impact applies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 19:03 vuln.today

DescriptionCVE.org

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending re-pairing requests with empty scope sets to skip containment guards and retain unauthorized device access.

AnalysisAI

Scope containment bypass in OpenClaw before 2026.4.25 allows authenticated operators to recover broader device access than their current authorization permits by exploiting a missing validation path in the device re-pairing flow. By sending re-pairing requests with empty scope sets, an operator can silently skip containment guards and retain or restore access to devices outside their assigned scope boundaries - an especially significant risk in multi-tenant or shared-operator deployments. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) implements a device scope containment model that enforces per-operator access boundaries during device re-pairing operations. The root cause maps to CWE-636 ('Not Failing Securely / Using the Insecure Alternative'), a logic flaw class where the application, upon receiving an anomalous or empty input, chooses the insecure path - in this case, skipping containment guard evaluation entirely rather than rejecting or defaulting to minimal scope. The flaw is a server-side authorization enforcement failure in the re-pairing handler, not a memory corruption or injection vulnerability; the empty scope set acts as a sentinel that the guard code fails to handle as an invalid or restricted case.

RemediationAI

The primary remediation is to upgrade OpenClaw to version 2026.4.25 or later, which is confirmed as the fix version by the vendor GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-8mg9-j9cf-54cj. If immediate patching is not feasible, restrict the device re-pairing API endpoint to only highly privileged or individually authorized accounts rather than general operator-level roles, thereby reducing the population of users who can invoke re-pairing. Additionally, deploy monitoring or alerting for re-pairing API requests that contain empty or null scope parameters - these are anomalous in normal operations and would indicate exploitation attempts. Neither workaround eliminates the underlying flaw, so patching remains the definitive resolution; the scope-restriction mitigation may cause operational disruption if operators legitimately need re-pairing access, so scoping of the restriction should be validated against operational requirements.