PT-2026-49778 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-53861 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6

Description The macOS Swift exec feature contains an allowlist bypass. The issue occurs because the system fails to account for combined POSIX inline-command flags, which are shorthand ways of grouping multiple command-line options together. This allows attackers to execute shell content that bypasses the intended allowlist checks, potentially leading to unauthorized command execution depending on the operator configuration.

Recommendations Update to version 2026.5.6. Require approval for combined shell flag forms on macOS. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the macOS Swift exec feature when it is not needed.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-53861

GHSA-C226-Q6FX-6J6C

GHSA-G796-JQMX-WF9Q

Affected Products

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53861.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-c226-q6fx-6j6c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53861 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g796-jqmx-wf9q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c226-q6fx-6j6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53861 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/170168 · Telegram Post
• https://vulncheck.com/advisories/openclaw-allowlist-bypass-via-combined-posix-inline-flags-on-macos · Note
• https://t.me/cveNotify/170118 · Telegram Post
• https://t.me/cveNotify/168765 · Telegram Post