CVE-2026-53817: OpenClaw Control UI Locality Spoofing Vulnerability
Summary
CVE-2026-53817: OpenClaw: Control UI locality spoofing could mint a durable admin device token. Affects openclaw versions < 2026.5.22. Fixed in 2026.5.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an open-source package designed for managing device control interfaces, particularly in LAN environments. It allows users to pair devices and manage access through a Control UI. The package is widely used in scenarios where shared tokens are utilized for device authentication. However, its reliance on locality signals for pairing decisions has introduced a significant vulnerability that can be exploited if proper security measures are not in place.
Vulnerability Detail
The vulnerability arises from a flaw in the Control UI pairing mechanism, where a caller can spoof locality information to obtain a durable admin-capable device token. This issue is particularly concerning in LAN or shared-token configurations where the authenticity of locality signals is not adequately validated. If exploited, an attacker with network access could convert a temporary access path into a persistent admin token, allowing unauthorized control over devices even after the original shared token is rotated. This vulnerability is classified with a CVSS score of 8.0, indicating a high severity level.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5.22
This is the first release that contains the fix.
npm install openclaw@2026.5.22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For older deployments where immediate upgrading is not feasible, it is recommended to remove any unexpected paired devices and to avoid exposing Control UI pairing paths on networks with untrusted clients. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2026-53817 represents a significant security risk for users of the OpenClaw package, particularly in LAN and shared-token environments. It is crucial for users to upgrade to the patched version to mitigate this vulnerability and ensure the integrity of their device management systems.
See every vulnerability recorded for openclaw →
FAQ
CVE-2026-53817 is a vulnerability in the OpenClaw package that allows an attacker to spoof locality information and obtain a durable admin device token.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring any signup.
If immediate upgrading is not possible, remove unexpected paired devices and avoid exposing Control UI pairing paths on untrusted networks as a temporary workaround.
The vulnerability has a CVSS score of 8.0, indicating a high severity level and potential for significant impact if exploited.
Exploitation of this vulnerability could allow unauthorized users to gain persistent admin access to devices, compromising the security of the entire system.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
