PT-2026-49774 · Openclaw · Openclaw

Philip · Publicado 2026-06-16 · Atualizado 2026-06-16 · CVE-2026-53857

NVD

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.

Correção

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2026-53857

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8c59-hr4w-qg69 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-mutable-display-name-binding-in-zalo-allowfrom-policy · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53857 · Nota de Segurança