View on NVD →

nvd.nist.gov • July 25, 2026

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenClaw Token Revocation Bypass Vulnerability Disclosed A token revocation vulnerability, CVE-2026-53824, has been identified in OpenClaw versions prior to 2026.4.24. This flaw allows attackers with previously valid slash tokens to execute commands briefly after their tokens have been revoked, exploiting a timing issue during monitor refresh windows. The vulnerability is classified as CWE-613, indicating insufficient session expiration, and poses a risk of unauthorized command execution depending on the operator's configuration. Affected organizations include those using OpenClaw for automation and command execution, where revoked tokens could lead to significant operational impacts such as data loss or service disruption. The CVSS score is 6.5, reflecting the medium severity of the issue, as exploitation requires prior valid token access. Immediate upgrades to version 2026.4.24 or later are recommended to mitigate this risk. 1 sources 62

Extracted Entities

View on NVD →

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)