Loading vulnerability…
OpenClaw WebSocket operator scope privilege escalation
CVE-2026-53821 affects OpenClaw before version 2026.5.18. The vulnerability arises from improper authorization handling in WebSocket session establishment: the application accepts client-declared operator scopes before those scopes are bound to a server-approved pairing state or trusted-proxy authorization baseline. As a result, an unpaired Control UI client, or a restricted trusted-proxy Control UI client, can cause a live WebSocket connection to retain cached operator.admin authority and then use that elevated authorization to invoke admin-gated Gateway RPCs. The issue is an authorization weakness in session/scope handling rather than an authentication bypass in the abstract, and is mapped to CWE-862.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged or insufficiently authorized client to escalate to cached operator.admin authority on a live WebSocket connection. With that authority, the attacker can execute administrative Gateway RPCs that should be restricted, leading to unauthorized privileged actions with high potential impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to the Control UI and any exposed WebSocket endpoints to only fully trusted clients and networks, and disable or tightly constrain trusted-proxy deployments where restricted clients could reach the affected authorization path. As an interim control, enforce server-side validation of operator scopes before any privileged Gateway RPC is permitted, and monitor for WebSocket sessions invoking admin-gated RPCs from unpaired or unexpectedly low-privilege clients.
Patch, then assume compromise.
Upgrade OpenClaw to version 2026.5.18 or later, which addresses the improper acceptance of client-declared operator scopes prior to enforcement of the server-approved pairing or trusted-proxy authorization baseline.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.