PT-2026-49767 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-53850 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.25

Description A control scope enforcement bypass exists in the focus command. This allows authenticated callers to execute the command without proper authorization checks, enabling them to change the focus state outside of the intended caller authority. The practical impact depends on the gateway configuration and whether lower-trust input can reach the affected path.

Recommendations Update to version 2026.4.25. Restrict focus command access to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the focus command feature when it is not needed.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-53850

GHSA-GW2C-6HCG-5G52

GHSA-MPC8-JXJH-QPGH

Affected Products

Openclaw

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53850.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mpc8-jxjh-qpgh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gw2c-6hcg-5g52 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53850 · Security Note
• https://osv.dev/vulnerability/GHSA-mpc8-jxjh-qpgh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53850 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/168755 · Telegram Post
• https://vulncheck.com/advisories/openclaw-control-scope-enforcement-bypass-in-focus-command · Note