CVE-2026-53828

Analyzed Analyzed - Analysis Complete

Authorization Bypass in OpenClaw Native Command Handling

Publication date: 2026-06-12

Last updated on: 2026-06-16

Assigner: VulnCheck

Description

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement. Attackers can trigger native command handling to bypass the configured owner-command access control, potentially executing privileged commands from unauthorized users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-16

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-02

NVD

CVE-2026-53828

EUVD

EUVD-2026-36616

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.5.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.6 and involves an authorization bypass in the native command handling feature.

Authenticated users can exploit this flaw to execute commands that are normally restricted to the owner, bypassing the intended access control policies.

This means that users with limited privileges can perform privileged actions by triggering native command handling improperly.

Impact Analysis

The vulnerability allows unauthorized users with some level of authentication to execute owner-only commands, potentially leading to unauthorized privileged actions.

This can result in unauthorized access to sensitive functions, data manipulation, or disruption of normal operations within the affected system.

Given the high severity scores (CVSS v3.1 score of 8.8), the impact can be significant, including confidentiality, integrity, and availability breaches.

Hi! I’m here to help you understand CVE-2026-53828. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70