---
id: CVE-2026-53817
title: 'OpenClaw: Control UI locality spoofing could mint a durable admin device token'
summary: 'OpenClaw: Control UI locality spoofing could mint a durable admin device token'
severity: high
cvss: 8
cwe:
  - CWE-284
  - CWE-287
  - CWE-290
  - CWE-863
vendor: openclaw
product: openclaw
ecosystem: npm
affected:
  - openclaw < 2026.5.22
patched:
  - openclaw 2026.5.22
published: '2026-07-02'
updated: '2026-07-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-chr9-m4q2-76hw'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-chr9-m4q2-76hw
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53817'
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-control-ui-locality-spoofing-in-device-pairing
  - url: 'https://github.com/advisories/GHSA-chr9-m4q2-76hw'
tags:
  - ghsa
  - npm
epss: 0.00447
epssPercentile: 0.36261
ingestedAt: '2026-07-02T16:39:34.599Z'
---

## Overview

### Summary

In affected LAN/shared-token Control UI deployments, a caller could spoof locality information used during Control UI pairing and obtain a durable admin-capable device token.

This issue is limited to deployments where the caller already has the network/authentication foothold needed to reach the Control UI pairing path. It is not an unauthenticated internet exposure issue.

### Affected configurations

This affects configurations such as LAN-bound gateways or shared-token Control UI access where locality signals were accepted as sufficient for pairing decisions.

### Impact

A temporary or shared Control UI access path could be turned into a persistent admin device token. That token could remain useful after the shared gateway token was rotated, unless the paired device was removed.

The issue is a pairing/locality validation problem: locality-derived trust was stronger than it should have been.

### Patched Versions

The first stable patched version is `2026.5.22`.

### Mitigations

Upgrade to `openclaw@2026.5.22` or later. For older deployments, remove unexpected paired devices and avoid exposing Control UI pairing paths on networks with untrusted clients.

## Affected packages

- `openclaw < 2026.5.22`

## Remediation

Upgrade to a patched release:

- `openclaw 2026.5.22`