EXECUTIVE SUMMARY:
Multiple security advisories affecting OpenClaw reveal a broad set of trust-boundary and authorization weaknesses across its gateway, plugin, node, browser, and messaging components. These vulnerabilities mainly stem from improper validation of identity metadata, policy enforcement gaps, approval bypasses, provenance failures, and insufficient boundary isolation. Collectively, these flaws could allow privilege escalation, unauthorized command execution, owner-only tool abuse, plugin loading from untrusted sources, SSRF bypass, message disclosure, and persistent admin token abuse. Most issues require authenticated or semi-trusted access, but they significantly weaken OpenClaw’s intended security model in shared or lower-trust deployments. Organizations using OpenClaw should prioritize upgrading to the latest stable patched releases and restrict exposure of sensitive features such as hooks, browser control, and third-party integrations.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple security advisories affecting OpenClaw reveal a broad set of trust-boundary and authorization weaknesses across its gateway, plugin, node, browser, and messaging components. These vulnerabilities mainly stem from improper validation of identity metadata, policy enforcement gaps, approval bypasses, provenance failures, and insufficient boundary isolation. Collectively, these flaws could allow privilege escalation, unauthorized command execution, owner-only tool abuse, plugin loading from untrusted sources, SSRF bypass, message disclosure, and persistent admin token abuse. Most issues require authenticated or semi-trusted access, but they significantly weaken OpenClaw’s intended security model in shared or lower-trust deployments. Organizations using OpenClaw should prioritize upgrading to the latest stable patched releases and restrict exposure of sensitive features such as hooks, browser control, and third-party integrations.[emaillocker id="1283"]
CVE-2026-53811 with a CVSS score of 7.7 - Mutable Matrix display names could be abused to impersonate allowlisted identities, enabling unauthorized agent access intended for another user.
CVE-2026-53806 with a CVSS score of 7.7 - An OpenClaw exec revalidation flaw allows combined POSIX shell flags to be parsed inconsistently between approval and execution, potentially bypassing allowlist restrictions and enabling unauthorized inline shell command execution.
CVE-2026-53816 with a CVSS score of 8.6 - An OpenClaw provenance validation flaw allows a malicious or compromised paired node to inject forged exec lifecycle events, potentially exposing unauthorized execution capabilities through the gateway.
CVE-2026-53818 with a CVSS score of 6.9 - An OpenClaw MCP loopback authorization flaw allows non-owner users to bypass owner-only tool policies and pre-execution hooks, potentially invoking privileged actions without proper access controls.
CVE-2026-53813 with a CVSS score of 7.3 - An OpenClaw package root resolution flaw allows workspace-controlled fake package roots to redirect memory-core artifact loading to unintended local locations, potentially causing unauthorized artifact execution.
CVE-2026-53809 with a CVSS score of 4.8 - An OpenClaw embedded runner policy flaw allows provider alias confusion to bypass canonical provider validation, potentially granting unauthorized bundled tool access outside intended policy restrictions.
CVE-2026-53819 with a CVSS score of 8.7 - An OpenClaw environment variable injection flaw allows a workspace .env file to override Homebrew executable selection during skill installation, potentially leading to execution of unintended or malicious binaries.
CVE-2026-35630 with a CVSS score of 7.5 - An OpenClaw QQBot authorization flaw allows unauthorized users to approve pending exec or plugin requests through native approval buttons, potentially enabling privileged actions without proper approver validation.
CVE-2026-53814 with a CVSS score of 8.7 - An OpenClaw hook ingress privilege escalation flaw allows a valid hook token holder to trigger agent runs with owner-scoped MCP loopback authority, potentially accessing owner-only tools.
CVE-2026-53817 with a CVSS score of 8.7 - An OpenClaw Control UI pairing validation flaw allows attackers with LAN or shared-token access to spoof locality information and obtain persistent admin-capable device tokens.
CVE-2026-53810 with a CVSS score of 7.7 - An OpenClaw marketplace extension metadata flaw allows hidden or unscanned payloads to be loaded during plugin installation, potentially enabling execution of unreviewed or malicious plugin code.
CVE-2026-53812 with a CVSS score of 4.9 - An OpenClaw browser control SSRF bypass flaw allows Playwright action-triggered navigation to private or loopback addresses after initial validation, enabling unauthorized access to internal page content.
CVE-2026-53815 with a CVSS score of 7.1 - An OpenClaw message read authorization flaw allows bypass of channel allowlist checks, enabling lower-trust users to access messages from restricted channels.
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-7hxm-f538-3xp6
https://github.com/advisories/GHSA-vxx3-6hc9-7cc3
https://github.com/advisories/GHSA-3c6j-hq33-3jv4
https://github.com/advisories/GHSA-rj6p-xmxr-qj4h
https://github.com/advisories/GHSA-v8cx-933x-r976
https://github.com/advisories/GHSA-p39j-x9h5-q66m
https://github.com/advisories/GHSA-8wg3-5mcm-fjq8
https://github.com/advisories/GHSA-mgq6-vr84-7m2j
https://github.com/advisories/GHSA-6fvr-66p3-3qj4
https://github.com/advisories/GHSA-chr9-m4q2-76hw
https://github.com/advisories/GHSA-v6r2-jh58-xx6w
https://github.com/advisories/GHSA-2hfg-4fh4-qp7f
https://github.com/advisories/GHSA-q7q8-3mgw-q67r