Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.22 and involves a flaw in the Control UI pairing process. Specifically, it is a locality validation vulnerability that allows attackers who have network access to spoof locality information. By doing so, attackers can obtain durable device tokens that grant administrative capabilities.

The core issue is insufficient validation of trust based on locality, which enables attackers to convert temporary shared access tokens into persistent administrative credentials. These credentials remain valid even after token rotation, allowing continued unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact by allowing attackers to gain persistent administrative access to devices running OpenClaw. With such access, attackers can control the device, potentially manipulate its functions, access sensitive data, or disrupt operations.

Because the administrative credentials obtained are durable and survive token rotation, the attacker’s access is long-lasting and difficult to revoke, increasing the risk and severity of compromise.

Useful 0 Not Useful 0