Locality Validation Bypass in OpenClaw Control UI

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.22 and involves a flaw in the Control UI pairing process. Specifically, it is a locality validation vulnerability that allows attackers who have network access to spoof locality information. By doing so, attackers can obtain durable device tokens that grant administrative capabilities.

The core issue is insufficient validation of trust based on locality, which enables attackers to convert temporary shared access tokens into persistent administrative credentials. These credentials remain valid even after token rotation, allowing continued unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact by allowing attackers to gain persistent administrative access to devices running OpenClaw. With such access, attackers can control the device, potentially manipulate its functions, access sensitive data, or disrupt operations.

Because the administrative credentials obtained are durable and survive token rotation, the attacker’s access is long-lasting and difficult to revoke, increasing the risk and severity of compromise.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to obtain persistent administrative credentials by spoofing locality information, which can lead to unauthorized access and control over devices.

Such unauthorized access and potential compromise of device integrity and availability could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data.

Specifically, the flaw undermines authentication and access control mechanisms, increasing the risk of data breaches or unauthorized data manipulation, which are critical concerns under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in OpenClaw before version 2026.5.22, you should upgrade to the patched version 2026.5.22.

Additionally, remove any unexpected paired devices manually to invalidate persistent admin-capable tokens that may have been created by exploiting the vulnerability.

Restrict Control UI pairing paths from untrusted networks to reduce the risk of locality spoofing attacks.

Useful 0 Not Useful 0