PT-2026-49780 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-53863 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.25

Description An input validation issue exists in tool group policy callers that accept unvalidated group IDs. An attacker capable of supplying a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, which may lead to the bypass of intended access controls. The practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

Recommendations Update to version 2026.4.25. Avoid exposing group-policy controlled tools to untrusted senders. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-53863

GHSA-8WMM-344F-MPJG

GHSA-985F-72MJ-8GF7

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53863.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-985f-72mj-8gf7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53863 · Security Note
• https://osv.dev/vulnerability/GHSA-8wmm-344f-mpjg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-985f-72mj-8gf7 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-unvalidated-group-id-acceptance-in-tool-group-policy · Note
• https://t.me/cveNotify/169605 · Telegram Post
• https://t.me/cveNotify/168767 · Telegram Post