PT-2026-48741 · Openclaw · Openclaw

Philip · CVE-2026-53811 · Published 2026-06-11 · Updated 2026-07-02

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.7

Description A privilege escalation issue exists in the Matrix allowFrom feature. Authenticated accounts can match policy entries by manipulating mutable display name metadata. This allows attackers who can change their display names to obtain agent access intended for a different Matrix identity, which may lead to unauthorized permissions based on the operator configuration.

Recommendations Update to version 2026.5.7 or later.

Exploit

Fix

LPE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-53811

GHSA-7HXM-F538-3XP6

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53811.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-53811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53811 · Security Note
• https://osv.dev/vulnerability/GHSA-7hxm-f538-3xp6 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-7hxm-f538-3xp6 · Patch, Vendor Advisory
• https://t.me/cveNotify/167229 · Telegram Post
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-mutable-display-names-in-matrix-allowfrom · Note
• https://t.me/CVEtracker/56614 · Telegram Post
• https://twitter.com/Tank23x0/status/2066852289172959547 · Twitter Post