{"id":"CVE-2026-53817","title":"OpenClaw: Control UI locality spoofing could mint a durable admin device token","summary":"OpenClaw: Control UI locality spoofing could mint a durable admin device token","severity":"high","cvss":8,"cwe":["CWE-284","CWE-287","CWE-290","CWE-863"],"vendor":"openclaw","product":"openclaw","ecosystem":"npm","affected":["openclaw < 2026.5.22"],"patched":["openclaw 2026.5.22"],"published":"2026-07-02","updated":"2026-07-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-chr9-m4q2-76hw","references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chr9-m4q2-76hw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53817"},{"url":"https://www.vulncheck.com/advisories/openclaw-control-ui-locality-spoofing-in-device-pairing"},{"url":"https://github.com/advisories/GHSA-chr9-m4q2-76hw"}],"tags":["ghsa","npm"],"epss":0.00309,"epssPercentile":0.23914,"ingestedAt":"2026-07-02T16:39:34.599Z","slug":"CVE-2026-53817","body":"## Overview\n\n### Summary\n\nIn affected LAN/shared-token Control UI deployments, a caller could spoof locality information used during Control UI pairing and obtain a durable admin-capable device token.\n\nThis issue is limited to deployments where the caller already has the network/authentication foothold needed to reach the Control UI pairing path. It is not an unauthenticated internet exposure issue.\n\n### Affected configurations\n\nThis affects configurations such as LAN-bound gateways or shared-token Control UI access where locality signals were accepted as sufficient for pairing decisions.\n\n### Impact\n\nA temporary or shared Control UI access path could be turned into a persistent admin device token. That token could remain useful after the shared gateway token was rotated, unless the paired device was removed.\n\nThe issue is a pairing/locality validation problem: locality-derived trust was stronger than it should have been.\n\n### Patched Versions\n\nThe first stable patched version is `2026.5.22`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.5.22` or later. For older deployments, remove unexpected paired devices and avoid exposing Control UI pairing paths on networks with untrusted clients.\n\n## Affected packages\n\n- `openclaw < 2026.5.22`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `openclaw 2026.5.22`","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}