https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T17:53:49.317096+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53817 BREW-openclaw-cli-CVE-2026-53817 — OpenClaw: Control UI locality spoofing could mint a durable admin device token 2026-09-28T17:53:49.319015+00:00

Affected: Homebrew: openclaw-cli

### Summary

In affected LAN/shared-token Control UI deployments, a caller could spoof locality information used during Control UI pairing and obtain a durable admin-capable device token.

This issue is limited to deployments where the caller already has the network/authentication foothold needed to reach the Control UI pairing path. It is not an unauthenticated internet exposure issue.

### Affected configurations

This affects configurations such as LAN-bound gateways or shared-token Control UI access where locality signals were accepted as sufficient for pairing decisions.

### Impact

A temporary or shared Control UI access path could be turned into a persistent admin device token. That token could remain useful after the shared gateway token was rotated, unless the paired device was removed.

The issue is a pairing/locality validation problem: locality-derived trust was stronger than it should have been.

### Patched Versions

The first stable patched version is `2026.5.22`.

### Mitigations

Upgrade to `openclaw@2026.5.22` or later. For older deployments, remove unexpected paired devices and avoid exposing Control UI pairing paths on networks with untrusted clients.

 https://db.gcve.eu/vuln/cve-2026-53817 CVE-2026-53817 — OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing 2026-09-28T17:53:49.319144+00:00

Affected: OpenClaw

OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attackers can exploit insufficient locality-derived trust validation to convert temporary shared access into persistent administrative credentials that survive token rotation.