PT-2026-48736 · Openclaw · Openclaw

Edward-X · CVE-2026-53806 · Published 2026-06-11 · Updated 2026-07-02

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12

Description A shell option parsing issue allows combined POSIX shell flags to bypass exec revalidation checks. This enables attackers to execute inline shell content without the intended allowlist validation, potentially leading to unauthorized command execution when the affected feature is enabled.

Recommendations Update to version 2026.5.12. As a temporary mitigation, disable the affected feature.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-53806

GHSA-VXX3-6HC9-7CC3

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53806.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-53806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53806 · Security Note
• https://osv.dev/vulnerability/GHSA-vxx3-6hc9-7cc3 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vxx3-6hc9-7cc3 · Patch, Vendor Advisory
• https://vulncheck.com/advisories/openclaw-shell-option-parsing-bypass-in-exec-revalidation · Note
• https://twitter.com/CCBalert/status/2066437942797557838 · Twitter Post
• https://twitter.com/HugoValters/status/2065495081558122857 · Twitter Post
• https://t.me/cveNotify/167224 · Telegram Post