PT-2026-48738 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-53808 · Published 2026-06-11 · Updated 2026-07-02

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6

Description An approval policy bypass exists in the Skill Workshop apply flow. This issue allows agent tool calls to set the apply variable to true even when the approvalPolicy is configured as pending. An attacker can reach the affected apply path to implement workshop changes before the required approval step, which may lead to unauthorized configuration modifications.

Recommendations Update to version 2026.5.6.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-807

Related Identifiers

CVE-2026-53808

GHSA-CQWV-9QJX-VXW2

Affected Products

Openclaw

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53808.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-53808 · Security Note
• https://osv.dev/vulnerability/GHSA-cqwv-9qjx-vxw2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53808 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cqwv-9qjx-vxw2 · Patch, Vendor Advisory
• https://t.me/cveNotify/167226 · Telegram Post
• https://t.me/CVEtracker/56611 · Telegram Post
• https://vulncheck.com/advisories/openclaw-approval-policy-bypass-in-skill-workshop-apply-flow · Note