PT-2026-49777 · Unknown+1 · Bluebubbles+1

Edward-X · CVE-2026-53860 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.7

Description A sender policy bypass exists in BlueBubbles where participants can match allowlist entries using conversation metadata instead of a stable sender identity. Attackers capable of influencing conversation-level identifiers can receive agent responses intended for configured senders, which may lead to the bypass of access controls.

Recommendations Update to version 2026.5.7. Prefer stable sender identifiers and keep BlueBubbles groups restricted. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the BlueBubbles feature when it is not needed.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-807

Related Identifiers

CVE-2026-53860

GHSA-8HJ2-W4C9-FJFQ

GHSA-8J37-5W68-WJ2G

Affected Products

Bluebubbles

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53860.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8j37-5w68-wj2g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53860 · Security Note
• https://osv.dev/vulnerability/GHSA-8j37-5w68-wj2g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53860 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8hj2-w4c9-fjfq · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/170117 · Telegram Post
• https://t.me/cveNotify/168764 · Telegram Post
• https://vulncheck.com/advisories/openclaw-sender-policy-bypass-via-mutable-conversation-identifiers-in-bluebubbles · Note