Executive Summary

CVE-2026-53852 is a scope containment bypass vulnerability in OpenClaw versions before 2026.4.25. It occurs during device re-pairing when authenticated operators submit re-pairing requests with empty scope sets. This allows them to bypass the intended containment guards and restore or retain broader device access scopes than intended.

The vulnerability specifically affects the device re-pairing feature and can confuse the scope containment logic, enabling unauthorized access retention. It does not affect the overall trusted-operator model but can be exploited if the feature is enabled and accessible.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers who are authenticated operators to bypass scope restrictions during device re-pairing, enabling them to retain unauthorized access to devices. This means that even after re-pairing attempts, unauthorized device access can persist.

The practical impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable re-pairing path. If exploited, it could lead to broader access than intended, potentially compromising device security.

Mitigations include revoking unexpected device sessions, requiring fresh pairing for suspicious devices, keeping allowlists narrow, avoiding sharing Gateways between untrusted users, and disabling the affected feature if not needed.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for device re-pairing requests that contain empty scope sets, as these requests bypass the intended scope containment.

Since the vulnerability is specific to the device re-pairing feature in OpenClaw versions prior to 2026.4.25, you can inspect logs or network traffic for re-pairing requests with empty scope parameters.

No specific commands are provided in the available resources, but general approaches include:

• Review OpenClaw device re-pairing logs for entries where the scope set is empty.
• Use network monitoring tools (e.g., tcpdump, Wireshark) to capture and filter re-pairing requests and check for empty scope fields.
• Audit authenticated operator actions related to device re-pairing to identify suspicious empty-scope requests.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading OpenClaw to version 2026.4.25 or later, where the vulnerability is patched.

Until the patch can be applied, it is recommended to revoke unexpected device sessions and require fresh pairing for suspicious devices.

Additional hardening measures include:

• Keep channel and tool allowlists narrow to limit exposure.
• Avoid sharing one Gateway between mutually untrusted users.
• Disable the affected device re-pairing feature if it is not needed.

Useful 0 Not Useful 0