PT-2026-49762 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-53845 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6

Description A hook bypass issue exists where skill commands routed through a specific dispatch path skip the runBeforeToolCallHook coverage. This allows attackers to send skill commands through the affected path to bypass hook-based auditing and policy enforcement mechanisms. The impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable path.

Recommendations Update to version 2026.5.6. Avoid relying on hook-only enforcement for skill commands. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-53845

GHSA-68XW-R643-9P5W

GHSA-R7VV-6763-M739

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53845.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-68xw-r643-9p5w · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7vv-6763-m739 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68xw-r643-9p5w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53845 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/168875 · Telegram Post
• https://vulncheck.com/advisories/openclaw-skill-command-dispatch-hook-bypass-via-before-tool-call-hook-skipping · Note
• https://t.me/cveNotify/168750 · Telegram Post