PT-2026-49765 · Openclaw · Openclaw

Chinmohan Nayak · Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-53848

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation by leveraging transparent command wrappers to perform unintended operations.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-53848

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-cwpp-5962-q4f6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53848 · Security Note
• https://vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-transparent-command-wrappers · Note