← Back

CVE-2026-53852

nvd nist
Published: Jun 16, 2026Modified: Jun 17, 2026

JSON object

Loading...
2.3
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)

Description

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending re-pairing requests with empty scope sets to skip containment guards and retain unauthorized device access.

Affected (12)

Products: Openclaw: Openclaw
Openclaw
1 product
Openclaw
Configuration A
12 vulnerable
Vulnerable SoftwareAffected Versions
Openclaw
Openclaw
Before 2026.4.25
Openclaw
Version 2026.4.25 beta10
Openclaw
Version 2026.4.25 beta11
Openclaw
Version 2026.4.25 beta1
Openclaw
Version 2026.4.25 beta2
Openclaw
Version 2026.4.25 beta3
Openclaw
Version 2026.4.25 beta4
Openclaw
Version 2026.4.25 beta5
Openclaw
Version 2026.4.25 beta6
Openclaw
Version 2026.4.25 beta7
Openclaw
Version 2026.4.25 beta8
Openclaw
Version 2026.4.25 beta9

Related CWEs

CWE-636
Not Failing Securely ('Failing Open')
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

References (2)

Source: disclosure@vulncheck.com
Vendor Advisory
Source: disclosure@vulncheck.com
Third Party Advisory

Timeline

No history available yet.