PT-2026-49027 · Openclaw · Openclaw

Philip · CVE-2026-53823 · Published 2026-06-12 · Updated 2026-07-02

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.3

Description A privilege escalation issue exists in the allowFrom feature, which binds to mutable Slack display names. Attackers with access to a Slack account can modify display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other identities.

Recommendations Update to version 2026.5.3.

Exploit

Fix

LPE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-53823

GHSA-C29C-2Q9C-PC86

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53823.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-c29c-2q9c-pc86 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53823 · Security Note
• https://osv.dev/vulnerability/GHSA-c29c-2q9c-pc86 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/Tank23x0/status/2069435812316668209 · Twitter Post
• https://twitter.com/infoflowcloud/status/2065842069055103313 · Twitter Post
• https://twitter.com/CVEnew/status/2065840918922465719 · Twitter Post
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-mutable-slack-display-names-in-allowfrom · Note