A flaw in the Control UI pairing process of OpenClaw versions prior to 2026.5.22 allows a malicious actor with network access to fake the locality information used for trust decisions. By spoofing locality, an attacker can convert a temporary shared access token into a durable, admin‑capable token that remains valid even after normal token rotation. This results in unauthorized administrative control of the device, compromising confidentiality, integrity, and availability of any data or services hosted on the device.

The vulnerability affects the OpenClaw platform, specifically any installations of OpenClaw older than version 2026.5.22. Users running those versions should verify their deployment and plan to update.

The CVSS score of 8.7 indicates high severity, and while an EPSS score is not available, the lack of a published exploit does not diminish the risk of future exploitation. The vulnerability is not listed in CISA’s KEV catalog, but the attack path requires only network connectivity to the Control UI, making it a likely vector for attackers on the same network or with remote network access.