AI Threat AlertOpenClaw before version 2026.5.26 contains an authorization bypass (CWE-613, Insufficient Session Expiration) that allows any attacker holding a previously-paired device session to silently re-establish WebSocket node-level access even after an administrator has explicitly revoked it. With a CVSS of 8.8, network-accessible attack surface, low attack complexity, and no user interaction required, this vulnerability directly defeats the revocation controls that security teams rely on to contain compromised access during incident response. In AI agent deployments, node-level WebSocket access translates to the ability to observe, inject into, or manipulate agent workflows—making this a persistence vector that survives standard containment actions. Patch immediately to 2026.5.26; if patching cannot be done immediately, rotate all node tokens, invalidate all pairing-scoped device sessions, and restrict WebSocket access to trusted network segments.
What is the risk?
High severity. CVSS 8.8 with AV:N/AC:L/PR:L/UI:N places this in the range exploitable by any low-privileged attacker who previously achieved device pairing. The core danger is that it defeats a fundamental security primitive: access revocation. An attacker who establishes a foothold through social engineering, a compromised endpoint, or insider access becomes effectively permanent even after detection and response. No public exploits or Nuclei scanner templates exist at time of disclosure and EPSS data is not yet available, but the trivially low attack complexity means exploitation risk will escalate rapidly as awareness of this disclosure spreads.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade to OpenClaw 2026.5.26 or later immediately—this is the only complete remediation.
If patching must be deferred, manually invalidate and rotate all active node tokens and pairing-scoped device sessions across the deployment.
Audit WebSocket connection logs for re-establishment events that follow revocation actions—these are direct indicators of exploitation or attempted exploitation.
Restrict WebSocket access to known, trusted IP ranges via firewall rules or network policy controls.
Review and reduce tool permissions granted to OpenClaw agent nodes to limit blast radius if unauthorized access is already in progress.
Implement alerting on WebSocket reconnection events from devices flagged as revoked.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-53843?
OpenClaw before version 2026.5.26 contains an authorization bypass (CWE-613, Insufficient Session Expiration) that allows any attacker holding a previously-paired device session to silently re-establish WebSocket node-level access even after an administrator has explicitly revoked it. With a CVSS of 8.8, network-accessible attack surface, low attack complexity, and no user interaction required, this vulnerability directly defeats the revocation controls that security teams rely on to contain compromised access during incident response. In AI agent deployments, node-level WebSocket access translates to the ability to observe, inject into, or manipulate agent workflows—making this a persistence vector that survives standard containment actions. Patch immediately to 2026.5.26; if patching cannot be done immediately, rotate all node tokens, invalidate all pairing-scoped device sessions, and restrict WebSocket access to trusted network segments.
Is CVE-2026-53843 actively exploited?
No confirmed active exploitation of CVE-2026-53843 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-53843?
1. Upgrade to OpenClaw 2026.5.26 or later immediately—this is the only complete remediation. 2. If patching must be deferred, manually invalidate and rotate all active node tokens and pairing-scoped device sessions across the deployment. 3. Audit WebSocket connection logs for re-establishment events that follow revocation actions—these are direct indicators of exploitation or attempted exploitation. 4. Restrict WebSocket access to known, trusted IP ranges via firewall rules or network policy controls. 5. Review and reduce tool permissions granted to OpenClaw agent nodes to limit blast radius if unauthorized access is already in progress. 6. Implement alerting on WebSocket reconnection events from devices flagged as revoked.
What systems are affected by CVE-2026-53843?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration, WebSocket-connected agent nodes, multi-agent systems.
What is the CVSS score for CVE-2026-53843?
CVE-2026-53843 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.27%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0049Exploit Public-Facing ApplicationAML.T0091.000Application Access TokenAML.T0108AI AgentCompliance Controls Affected
What are the technical details?
Original Advisory
OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.
Exploitation Scenario
A threat actor—whether a former employee, a compromised developer endpoint, or an insider—previously paired a device with an OpenClaw deployment. After the pairing is discovered and an administrator explicitly revokes the session, the attacker's client uses the surviving pairing-scoped device session to silently re-establish the WebSocket connection and reclaim node token authority without any administrator approval or alert. In an AI agent context, the attacker now has persistent access to observe all agent activity, inject malicious instructions into the agent's task queue, exfiltrate sensitive outputs including API responses, retrieved documents, and tool results, or manipulate agent behavior at will—all while the security team believes the threat has been contained and the incident is closed.
Weaknesses (CWE)
CWE-284Improper Access ControlPrimaryCWE-613DEPRECATED: Insufficient Session ExpirationPrimaryCWE-863Incorrect AuthorizationPrimaryCWE-613DEPRECATED: Insufficient Session ExpirationCWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-221729.9OpenClaw: WebSocket scope self-elevation grants admin
Same package: openclawCVE-2026-335799.9OpenClaw: scope bypass escalates low-priv to admin
Same package: openclawCVE-2026-329229.9OpenClaw: privilege escalation to RCE via token scope bypass
Same package: openclawCVE-2026-320389.8OpenClaw: sandbox bypass enables container lateral movement
Same package: openclawCVE-2026-538389.8OpenClaw: approval scope bypass via reconnection state
Same package: openclaw