CVE-2026-53843: OpenClaw Node Token Authority Revocation Bypass Vulnerability
Summary
CVE-2026-53843: OpenClaw: Pairing-scoped device session could restore revoked node token authority. Affects openclaw versions < 2026.5.26. Fixed in 2026.5.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source library designed for managing device sessions and token authority in IoT applications. It enables secure pairing and communication between devices, ensuring that only authorized devices can access certain functionalities. However, a flaw in its token revocation mechanism allows devices to retain authority even after being revoked, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of pairing-scoped sessions for devices. When a node token is revoked, the expectation is that the device loses its authority. However, in affected versions, a device can re-establish its node token authority without going through the normal approval process. This can lead to unauthorized access and prolonged node-level access, undermining the effectiveness of token revocation as a security control.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5.26
This is the first release that contains the fix.
npm install openclaw@2026.5.26Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade immediately, a temporary workaround is to restart the gateway and remove/re-pair the affected device. This will help ensure that no stale session remains active, thereby mitigating the risk until a proper update can be applied.
Conclusion
The CVE-2026-53843 vulnerability in OpenClaw poses a significant risk by allowing devices to regain node token authority after revocation. It is crucial to upgrade to the patched version 2026.5.26 to mitigate this risk. Users should also consider using Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows devices that should have lost their node token authority to regain it without renewed approval, potentially leading to unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
All versions prior to 2026.5.26 are affected by this vulnerability.
As a temporary measure, restart the gateway and remove/re-pair the affected device to mitigate the risk until you can apply the update.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
