PT-2026-48739 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-53809 · Published 2026-06-11 · Updated 2026-07-02

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.25

Description A policy bypass exists in the embedded runner policy. This issue allows requests using provider aliases to be compared against aliases rather than canonical provider identities. When the affected feature is enabled, this confusion can be exploited to obtain bundled tool access that exceeds the intended provider policy restrictions.

Recommendations Update to version 2026.4.25.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-53809

GHSA-P39J-X9H5-Q66M

Affected Products

Openclaw

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53809.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-53809 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p39j-x9h5-q66m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53809 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-p39j-x9h5-q66m · Patch, Vendor Advisory
• https://t.me/cveNotify/167227 · Telegram Post
• https://t.me/CVEtracker/56612 · Telegram Post
• https://vulncheck.com/advisories/openclaw-provider-alias-confusion-in-embedded-runner-policy · Note