CVE-2026-53817: OpenClaw: Control UI locality spoofing could mint a durable admin device token

July 2, 2026

In affected LAN/shared-token Control UI deployments, a caller could spoof locality information used during Control UI pairing and obtain a durable admin-capable device token.

This issue is limited to deployments where the caller already has the network/authentication foothold needed to reach the Control UI pairing path. It is not an unauthenticated internet exposure issue.

References

github.com/advisories/GHSA-chr9-m4q2-76hw
github.com/openclaw/openclaw/security/advisories/GHSA-chr9-m4q2-76hw
nvd.nist.gov/vuln/detail/CVE-2026-53817
www.vulncheck.com/advisories/openclaw-control-ui-locality-spoofing-in-device-pairing

Code Behaviors & Features

Detect and mitigate CVE-2026-53817 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →