What is CVE-2026-53838?

CVE-2026-53838 is a critical-severity vulnerability in Openclaw, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 9.8/10. Published 2026-06-12.

How severe is CVE-2026-53838?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Openclaw

CVE-2026-53838

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions.

Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)

EPSS: 0.002 (13.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Openclaw — versions 0, 2026.5.27

Weakness classification (CWE)

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition

References

disclosure@vulncheck.com (vendor-advisory, Mitigation, Vendor Advisory)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-53838?: CVE-2026-53838 is a critical-severity vulnerability in Openclaw, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 9.8/10. Published 2026-06-12.
How severe is CVE-2026-53838?: Critical severity. CVSS v3 base score is 9.8 out of 10.