CVE-2026-53823
Received Received - Intake
Privilege Escalation via Slack Display Name Spoofing in OpenClaw

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: VulnCheck

Description
OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other identities.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-13
AI Q&A
2026-06-13
EPSS Evaluated
N/A
NVD
CVE-2026-53823
EUVD
EUVD-2026-36611
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.5.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.3 and involves a privilege escalation issue in the allowFrom feature. The feature binds to mutable Slack display names, which attackers with access to a Slack account can manipulate. By changing their Slack display name metadata to match policy entries, attackers can potentially gain unauthorized agent access that is intended for other identities.

Impact Analysis

The vulnerability can allow attackers who have access to a Slack account to escalate their privileges within OpenClaw. By altering their Slack display name to match certain policy entries, they may gain unauthorized access to agent functions or data that should be restricted to other users. This could lead to unauthorized actions or data exposure within the affected system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53823. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart