Hostname Validation Bypass in OpenClaw

Publication date: 2026-06-12

Last updated on: 2026-06-16

Assigner: VulnCheck

Description

OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-16

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-02

NVD

CVE-2026-53839

EUVD

EUVD-2026-36627

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.5.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1023	The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.7 and involves hostname validation in retry endpoint checks. Instead of requiring an exact hostname match, the system allows matching based on hostname prefixes. This flaw enables attackers to craft a hostname prefix that resembles a trusted host, which can trick the system into sending authentication material to untrusted endpoints.

Impact Analysis

The vulnerability can lead to sensitive authentication material being sent to untrusted endpoints. This could allow attackers to intercept or misuse authentication credentials, potentially leading to unauthorized access or other security breaches.

Hi! I’m here to help you understand CVE-2026-53839. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70