PT-2026-49766 · Openclaw · Openclaw

Philip · Publicado 2026-06-16 · Atualizado 2026-06-16 · CVE-2026-53849

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

Correção

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2026-53849

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-cw4q-gqg5-g38h · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-mutable-discord-display-names-in-allowfrom · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53849 · Nota de Segurança