OpenClaw (< 2026.5.27) - CraftedSignal Threat Feed

OpenClaw Node Pairing Vulnerability Leads to Privilege Escalation

hello@craftedsignal.io — Fri, 03 Jul 2026 12:06:06 +0000

A critical vulnerability exists in OpenClaw, specifically affecting versions prior to 2026.5.27. This flaw, described as "Node pairing reconnection could confuse approval scope state," permits an already paired or reconnecting node session to manipulate its pairing state, altering the approval scope decision within the OpenClaw Gateway. This could result in a node being granted significantly broader authority than intended by the authenticated operator, effectively leading to privilege escalation. The vulnerability does not negate OpenClaw's trusted-operator model but targets scenarios where lower-trust input can reach the affected path during node reconnection. Defenders must prioritize patching to version 2026.5.27 or later to mitigate this risk and prevent potential unauthorized access or elevated privileges.

Attack Chain

An attacker, having established initial access or control over a low-privilege OpenClaw node, prepares to exploit the reconnection mechanism.
The attacker initiates a manipulated node reconnection session with the OpenClaw Gateway.
During the reconnection process, the attacker leverages the vulnerability in OpenClaw versions older than 2026.5.27.
The Gateway's internal state machine processes the manipulated reconnection, causing confusion in the node's pairing approval scope.
This confusion leads the Gateway to make an incorrect "approval scope decision" for the reconnecting node.
As a result, the node is granted "broader node authority" and elevated privileges beyond the operator's original intent.
The attacker can now execute unauthorized commands or access sensitive resources with the newly acquired elevated privileges within the OpenClaw environment.

Impact

When the affected OpenClaw feature is enabled and reachable, this vulnerability could restore or present broader node authority than the operator originally intended. The practical impact is contingent on the operator's specific configuration and whether lower-trust input can successfully reach the vulnerable code path. If exploited, an attacker could gain unauthorized access to functions or data previously restricted, leading to data compromise, system manipulation, or further lateral movement within the compromised environment.

Recommendation

Patch all OpenClaw instances to version 2026.5.27 or later immediately to remediate the vulnerability mentioned in the GHSA-83w9-h5wv-j9xm reference.
Revoke any unexpected or suspicious node pairings and re-pair only explicitly trusted nodes as a hardening measure until patching is complete.
As a general hardening practice, keep channel and tool allowlists as narrow as possible.
Avoid sharing a single OpenClaw Gateway between mutually untrusted users or applications.
Disable the affected node pairing feature when it is not actively required for operations.

OpenClaw Workspace .env Homebrew Executable Override Vulnerability (CVE-2026-53819)

hello@craftedsignal.io — Fri, 03 Jul 2026 12:01:45 +0000

The OpenClaw platform is affected by CVE-2026-53819, a high-severity vulnerability enabling a malicious .env file in a repository to manipulate the Homebrew executable selection during skill installation flows. Published by GHSA on July 2, 2026, this flaw permits the OpenClaw install helper to use an attacker-controlled Homebrew-compatible binary instead of the legitimate one. This occurs when a trusted operator opens an affected workspace and initiates a skill installation. The vulnerability, present in OpenClaw versions prior to 2026.5.27, affects macOS and Linux systems and poses a significant risk for arbitrary code execution, bypassing established security controls and potentially compromising the operator's environment.

Attack Chain

An attacker crafts a malicious repository that includes a .env file designed to alter environment variables that influence Homebrew's path resolution.
The attacker socially engineers a trusted OpenClaw operator to clone and open this malicious repository within their development workspace.
The trusted operator initiates a skill install flow within the newly opened, compromised workspace.
During the install process, the OpenClaw install helper parses the malicious .env file, causing it to load an incorrect or attacker-controlled path for the Homebrew executable.
Instead of executing the legitimate Homebrew binary, the system invokes an attacker-controlled Homebrew-compatible executable, which was likely bundled within the malicious repository.
The attacker-controlled executable runs with the operator's privileges, achieving arbitrary code execution on the host system.
This execution could lead to system compromise, data exfiltration, or further lateral movement within the network.

Impact

Successful exploitation of CVE-2026-53819 could allow an attacker to run arbitrary code on a trusted operator's system, leading to full system compromise. The practical impact depends on the specific configuration of the operator's environment and the attacker's payload. If lower-trust input can reach the affected path, it increases the likelihood and severity of compromise. This vulnerability could be leveraged for initial access, privilege escalation, or establishing persistence within targeted development environments, potentially affecting intellectual property or critical infrastructure if operators with elevated access are targeted.

Recommendation

Immediately patch OpenClaw to version 2026.5.27 or newer to remediate CVE-2026-53819.
Avoid running skill install flows from untrusted workspaces until all OpenClaw instances are updated to the patched version 2026.5.27.
As a general hardening measure, keep channel and tool allowlists narrow, as noted in the GHSA reference.
Disable the affected feature when it is not needed to reduce the attack surface for CVE-2026-53819.