https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:54:58 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53843 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>In affected releases, a surviving pairing-scoped session for a device could re-establish node token authority after that node token had been revoked. Revocation should require the device to lose that authority unless it is approved again through the normal pairing flow.</p> <p>This issue affects token revocation and device-role containment. It does not allow unauthenticated device creation.</p> <p>### Affected configurations</p> <p>This affects deployments where an already paired device keeps a same-device session with pairing-related scope after its node token is revoked.</p> <p>### Impact</p> <p>A device that should have lost node WebSocket authority could regain it without renewed approval. That weakens revocation as an operator control and can keep node-level access alive longer than intended.</p> <p>The impact is limited to devices that already had a legitimate pairing/session foothold.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.26`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.26` or later. If a node token was revoked on an older version, restart the gateway and remove/re-pair the affected device to ensure no stale session remains active.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>In affected releases, a surviving pairing-scoped session for a device could re-establish node token authority after that node token had been revoked. Revocation should require the device to lose that authority unless it is approved again through the normal pairing flow.</p> <p>This issue affects token revocation and device-role containment. It does not allow unauthenticated device creation.</p> <p>### Affected configurations</p> <p>This affects deployments where an already paired device keeps a same-device session with pairing-related scope after its node token is revoked.</p> <p>### Impact</p> <p>A device that should have lost node WebSocket authority could regain it without renewed approval. That weakens revocation as an operator control and can keep node-level access alive longer than intended.</p> <p>The impact is limited to devices that already had a legitimate pairing/session foothold.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.26`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.26` or later. If a node token was revoked on an older version, restart the gateway and remove/re-pair the affected device to ensure no stale session remains active.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53843 https://db.gcve.eu/vuln/cve-2026-53843 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.</p> https://db.gcve.eu/vuln/cve-2026-53843