CVE-2026-53816
CVE-2026-53816 · OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send crafted node.event messages to the gateway, steering target sessions into exec-event paths that expose capabilities the reduced node surface should not provide.
CVSS 8.6 · Élevée · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node