Loading vulnerability…
OpenClaw Node-Pairing Reconnection Approval-Scope State Mutation
CVE-2026-53838 is a state-mutation vulnerability in OpenClaw versions before 2026.5.27 affecting node-pairing reconnection logic. A paired or reconnecting node session can cause approval-scope state to be confused or altered, allowing the node to restore or present authority broader than the operator intended. This can result in bypass of node approval restrictions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to exercise the affected reconnection path may obtain broader node authority than intended by the operator and bypass approval-scope restrictions. The practical impact depends on the authority granted to nodes in the deployment and whether lower-trust input can reach the affected pairing and reconnection workflow.
If you can’t patch tonight, do this now.
Until an upgrade is deployed, revoke unexpected node pairings and re-pair only verified trusted nodes. Restrict node-pairing and reconnection activity from untrusted parties, review paired-node approval scopes, keep channel and tool allowlists narrowly scoped, avoid sharing a Gateway among mutually untrusted users, and disable the affected feature where it is not required.
Patch, then assume compromise.
Upgrade the OpenClaw npm package to version 2026.5.27 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.