Cyber Resilience

CVE-2026-53852

Openclaw ≤ 2026.4.25

Public PoC
Published
16 June 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v4 2.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0021 11th percentile
Risk Priority 26 floored blend · peak EPSS

Summary

CVE-2026-53852 is a low-severity Failing Open (CWE-636) vulnerability in Openclaw Openclaw. Its CVSS base score is 2.3 (Low).

Operationally, ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to CP-12 (Safe Mode) and SC-24 (Fail in Known State) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A10:2025 Mishandling of Exceptional Conditions

EU & UK References

Vulnerability Data

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending re-pairing requests with empty scope sets to…

more

skip containment guards and retain unauthorized device access.

CWE(s)
CWE-636

Related Threats

CVEs Like This One

CVE-2026-41334Same product: Openclaw Openclaw
CVE-2026-41377Same product: Openclaw Openclaw
CVE-2026-42423Same product: Openclaw Openclaw
CVE-2026-53837Same product: Openclaw Openclaw
CVE-2026-32970Same product: Openclaw Openclaw
CVE-2026-41297Same product: Openclaw Openclaw
CVE-2026-43570Same product: Openclaw Openclaw
CVE-2026-41298Same product: Openclaw Openclaw
CVE-2026-41392Same product: Openclaw Openclaw
CVE-2026-35626Same product: Openclaw Openclaw

Affected Assets

openclaw
openclaw
2026.4.25 · ≤ 2026.4.25

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.2.1
  • V7.4.1
  • V8.3.3
  • V10.3.4

Mitigating Controls (NIST 800-53 r5) AI

SC-24 Fail in Known State good match

SC-24 directly requires the system to fail to a known state that preserves security properties, structurally stopping fallback to a less-secure mode.

SI-17 Fail-safe Procedures good match

SI-17 mandates explicit fail-safe procedures that activate on indicated failures, preventing the insecure fallback behavior.

CP-12 Safe Mode good match

CP-12 forces entry into a safe mode on detected conditions, limiting exposure but not covering every failure path.

SA-8 Security and Privacy Engineering Principles partial match

SA-8 requires application of engineering principles that include fail-secure design, reducing the likelihood the weakness is introduced.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices explicitly include designing error and failure handling to remain in a secure state.

PR.AA-05 partial match
prevents

Least-privilege policy and enforcement directly counters the permissive-access fallback example in the CWE.

PR.PS-01 partial match
prevents

Hardened baselines and configuration management reduce the chance that error paths default to insecure settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.25 Assessment and decision on information security events none match
none

The control forces an explicit evaluation step before any response, reducing the chance that a failure condition will default to an unsafe open state.

References