VulnerabilityAnalyzed

CVE-2026-53862

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes.

LOW 2.3EPSS 0.09%

Does this matter?

Lower severity and a low EPSS score (0.09%). Track it; it rarely justifies an emergency change on its own.

Description

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.09% probability · 0th percentile
CISA KEV: Not listed
Weakness: CWE-266, CWE-345
Affected: openclaw/openclaw
Source: disclosure@vulncheck.com

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-9v8j-9c9g-w66cVendor Advisory
https://www.vulncheck.com/advisories/openclaw-bootstrap-token-replay-via-pending-pairing-scope-wideningThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.