OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes.
Date: 2026-06
Affected: openclaw/openclaw
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-53862
CWE: CWE-266
CWE-345
CVSS: 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.


Mitigations:

Architectural layers (MAESTRO):