CVE-2026-53843: OpenClaw < 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device Session
Summary
In affected releases, a surviving pairing-scoped session for a device could re-establish node token authority after that node token had been revoked. Revocation should require the device to lose that authority unless it is approved again through the normal pairing flow.
This issue affects token revocation and device-role containment. It does not allow unauthenticated device creation.
Affected configurations
This affects deployments where an already paired device keeps a same-device session with pairing-related scope after its node token is revoked.
Impact
A device that should have lost node WebSocket authority could regain it without renewed approval. That weakens revocation as an operator control and can keep node-level access alive longer than intended.
The impact is limited to devices that already had a legitimate pairing/session foothold.
Patched Versions
The first stable patched version is 2026.5.26.
Mitigations
Upgrade to openclaw@2026.5.26 or later. If a node token was revoked on an older version, restart the gateway and remove/re-pair the affected device to ensure no stale session remains active.
Other sources
OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.5.26 - Operational
If a node token was revoked on a version older than 2026.5.26, restart the gateway and remove and re-pair the affected device to ensure no stale pairing-scoped session remains active.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53843?
The severity of CVE-2026-53843 is rated high with a score of 8.8.
How does CVE-2026-53843 exploit authorization bypass?
CVE-2026-53843 allows attackers to bypass authorization by re-establishing node token authority after it has been revoked, using a surviving pairing-scoped device session.
How can I mitigate the risk of CVE-2026-53843?
To mitigate the risk of CVE-2026-53843, update OpenClaw to version 2026.5.26 or later.
What systems are affected by CVE-2026-53843?
CVE-2026-53843 affects all versions of OpenClaw prior to 2026.5.26.
What type of access does CVE-2026-53843 allow attackers to regain?
CVE-2026-53843 allows attackers with a paired device to regain WebSocket node-level access without requiring renewed approval.