PT-2026-49033 · Openclaw · Openclaw

Cantinagen + 1 · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-53829

Mitre

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval.

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2026-53829

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-xww8-gqvh-92x9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53829 · Security Note
• https://vulncheck.com/advisories/openclaw-command-truncation-in-exec-approval-display · Note