Loading vulnerability…
Authorization Bypass in OpenClaw Device Session Revocation
CVE-2026-53843 is a high-severity authorization bypass vulnerability in OpenClaw versions prior to 2026.5.26. The flaw occurs when a surviving pairing-scoped device session is able to re-establish node token authority after that authority has been revoked. As a result, revocation of node access does not fully invalidate the effective authorization state associated with an already paired device session. An attacker in possession of a previously paired device can regain node-level WebSocket access without renewed operator approval, undermining the intended security boundary around token revocation and session invalidation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized node-level WebSocket access to persist or be re-established after revocation, weakening a core access-control mechanism. This can expose node functionality and data to a device that should no longer be authorized, with potential confidentiality, integrity, and availability impact consistent with continued node-level access. The primary security consequence is that revocation cannot be relied upon to immediately and completely terminate access for an already paired device.
If you can’t patch tonight, do this now.
Until the fixed release is deployed, treat revocation on vulnerable versions as potentially incomplete for already paired devices. Restrict or closely monitor access by paired devices, especially those whose node authority has been revoked. Where practical, restart the gateway and remove and re-establish trusted pairings after revocation events to reduce the chance that a surviving session can restore authority. Monitor for unexpected or unauthorized node WebSocket access attempts.
Patch, then assume compromise.
Upgrade OpenClaw to version 2026.5.26 or later, which addresses the session and token authority restoration flaw. After upgrading, verify that revocation of device or node access fully invalidates any existing paired-device session state and that revoked devices cannot regain authority without a new approval flow. If revocation was performed on a vulnerable version, restart the gateway and remove and re-pair affected devices as needed to eliminate stale session state.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.