https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:53:49 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53817 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>In affected LAN/shared-token Control UI deployments, a caller could spoof locality information used during Control UI pairing and obtain a durable admin-capable device token.</p> <p>This issue is limited to deployments where the caller already has the network/authentication foothold needed to reach the Control UI pairing path. It is not an unauthenticated internet exposure issue.</p> <p>### Affected configurations</p> <p>This affects configurations such as LAN-bound gateways or shared-token Control UI access where locality signals were accepted as sufficient for pairing decisions.</p> <p>### Impact</p> <p>A temporary or shared Control UI access path could be turned into a persistent admin device token. That token could remain useful after the shared gateway token was rotated, unless the paired device was removed.</p> <p>The issue is a pairing/locality validation problem: locality-derived trust was stronger than it should have been.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.22`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.22` or later. For older deployments, remove unexpected paired devices and avoid exposing Control UI pairing paths on networks with untrusted clients.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>In affected LAN/shared-token Control UI deployments, a caller could spoof locality information used during Control UI pairing and obtain a durable admin-capable device token.</p> <p>This issue is limited to deployments where the caller already has the network/authentication foothold needed to reach the Control UI pairing path. It is not an unauthenticated internet exposure issue.</p> <p>### Affected configurations</p> <p>This affects configurations such as LAN-bound gateways or shared-token Control UI access where locality signals were accepted as sufficient for pairing decisions.</p> <p>### Impact</p> <p>A temporary or shared Control UI access path could be turned into a persistent admin device token. That token could remain useful after the shared gateway token was rotated, unless the paired device was removed.</p> <p>The issue is a pairing/locality validation problem: locality-derived trust was stronger than it should have been.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.22`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.22` or later. For older deployments, remove unexpected paired devices and avoid exposing Control UI pairing paths on networks with untrusted clients.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53817 https://db.gcve.eu/vuln/cve-2026-53817 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attackers can exploit insufficient locality-derived trust validation to convert temporary shared access into persistent administrative credentials that survive token rotation.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attackers can exploit insufficient locality-derived trust validation to convert temporary shared access into persistent administrative credentials that survive token rotation.</p> https://db.gcve.eu/vuln/cve-2026-53817