CVE-2026-53817highCWE-290

CVE-2026-53817: falha de alta gravidade em OpenClaw

OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar OpenClaw+ Monitorar openclaw

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.3%
OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attackers can exploit insufficient locality-derived trust validation to convert temporary shared access into persistent administrative credentials that survive token rotation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
OpenClaw · OpenClaw
CVEs relacionadas — OpenClaw

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25253HIGHCVE-2026-25253EPSS 32.4%CVE-2026-44112HIGHOpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge WritesEPSS 7.3%CVE-2026-32917CRITICALOpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCPEPSS 2.0%CVE-2026-53822HIGHOpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and ExecutionEPSS 1.1%CVE-2026-32052MEDIUMOpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv CarriersEPSS 0.9%CVE-2026-3689MEDIUMOpenClaw Canvas Path Traversal Information Disclosure VulnerabilityEPSS 0.9%