Dashboard / CVE-2026-53852

CVE-2026-53852

LOW
INFO Priority: 0.00 BB Relevance: 55/100
Published: 2026-06-16 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: Present
VC: Low
VI: Low
VA: None

Description

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending re-pairing requests with empty scope sets to skip containment guards and retain unauthorized device access.

Weakness Classification (1)

Affected Software (12)

VendorProductVersion
openclaw openclaw < 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25

References & Advisories (2)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

2.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.21%
Raw Score 0.002060
Percentile 10.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00206
2026-10-28
0.00206

Intelligence Sources

nvd ref →

External Links