p PatchFirst

CVE-2026-53828

CVE-2026-53828 · OpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcement

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement. Attackers can trigger native command handling to bypass the configured owner-command access control, potentially executing privileged commands from unauthorized users.

CVSS 7.7 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.5.6: Affected (semver)
    • 2026.5.6: Not affected (semver)

    Update to 2026.5.6

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.5.6

    Update to 2026.5.6

Original sources

Check your server →