CVE-2026-53816: OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

Paired nodes report lifecycle events back to the gateway in node.event messages. For exec events, the gateway did not tie the event to a system.run request it had authorized. A node could therefore send an exec result that was never requested, and the gateway treated that attacker-supplied data as genuine.

In the vulnerable flow, the forged event could push the target agent session into an exec-event path. That path exposed capabilities the reduced node surface was not meant to provide. The advisory does not list which capabilities.

The attacker must already control a paired node connection, so this is not an entry point from the internet. The CVSS vector reflects that with high privileges required. It is a privilege boundary problem: a node that should have narrow rights gains more. It matters most when nodes run in less trusted places such as developer laptops, shared build hosts or edge devices, and one of them is compromised. The target agent or session must also process exec lifecycle events.

Affected: npm package openclaw before 2026.5.18, in deployments with a paired node that can send crafted node.event messages and where the target agent or session handles exec lifecycle events.

npm ls openclaw

List your paired nodes and where each one runs. Nodes in environments you do not fully control are the ones that count.

Upgrade to openclaw 2026.5.18 or later, the first stable patched version.

npm install -g [email protected]

The advisory also says to pair nodes only from trusted environments, and to remove and re-pair any node that may have been compromised. The missing check was provenance for node-originated lifecycle events.

Review gateway logs for exec lifecycle events from a node with no matching system.run request just before them. Look for sessions that entered an exec-event path without a command the operator started. Check paired nodes for signs of compromise and re-pair any suspect one. The advisory lists no exact log strings.

Summary

OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that was accepted without enough provenance tying it to an authorized system.run request.

This issue affects the node event boundary. It does not allow an unauthenticated caller to reach the gateway; the attacker must already control a paired node connection.

Affected configurations

This affects deployments with a paired node where that node can send crafted node.event messages to the gateway and the target agent/session can process exec lifecycle events.

Impact

A malicious or compromised paired node could make the gateway treat attacker-supplied event data as an exec lifecycle result. In the vulnerable flow, that could steer the target session into an exec-event path that exposed capabilities the reduced node surface should not have provided.

The issue is a missing provenance check for node-originated lifecycle events.

Patched Versions

The first stable patched version is 2026.5.18.

Mitigations

Upgrade to [email protected] or later. Pair nodes only from trusted environments, and remove/re-pair nodes that may have been compromised.