PT-2026-49761 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-53844 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.29

Description A session visibility check bypass exists in the shared memory search of the memory-wiki feature. This allows authenticated callers to skip session visibility guards on the search path, enabling them to retrieve memory entries that should not be visible to their session without proper authorization.

Recommendations Update to version 2026.4.29. Limit shared memory search to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the shared memory search feature when it is not needed.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-53844

GHSA-6JM4-83G2-35GV

GHSA-72FW-CQH5-F324

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53844.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-72fw-cqh5-f324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53844 · Security Note
• https://osv.dev/vulnerability/GHSA-72fw-cqh5-f324 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53844 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jm4-83g2-35gv · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/168749 · Telegram Post
• https://vulncheck.com/advisories/openclaw-session-visibility-check-bypass-in-shared-memory-search · Note
• https://t.me/cveNotify/168874 · Telegram Post