p PatchFirst

CVE-2026-53809

CVE-2026-53809 · OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.

CVSS 4.8 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.4.25: Affected (semver)
    • 2026.4.25: Not affected (semver)

    Update to 2026.4.25

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.4.25

    Update to 2026.4.25

Original sources

Check your server →