CVE-2026-53809

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53809

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53809.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53809

Aliases

GHSA-p39j-x9h5-q66m

Downstream

MINI-67p3-c7xv-hr5x

Published

2026-06-11T20:06:43.118Z

Modified

2026-07-08T08:09:46.179426267Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

Details

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53809.json",
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type

GIT

Repo

https://github.com/openclaw/openclaw

Events

Introduced

Fixed

aa36ee670b76211426a2e89a84e9096453c01ee7

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.4.25"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v1.*

v1.0.4

v1.1.0

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v2.*

v2.0.0-beta1

v2.0.0-beta2

v2.0.0-beta3

v2.0.0-beta4

v2.0.0-beta5

v2026.*

v2026.1.10

v2026.1.11

v2026.1.11-1

v2026.1.11-2

v2026.1.11-3

v2026.1.12

v2026.1.12-2

v2026.1.13

v2026.1.14-1

v2026.1.15

v2026.1.16-2

v2026.1.20

v2026.1.21

v2026.1.22

v2026.1.23

v2026.1.24

v2026.1.24-1

v2026.1.29

v2026.1.30

v2026.1.5

v2026.1.5-1

v2026.1.5-2

v2026.1.5-3

v2026.1.8

v2026.1.9

v2026.2.1

v2026.2.12

v2026.2.13

v2026.2.14

v2026.2.15-beta.1

v2026.2.17

v2026.2.19

v2026.2.19-beta.1

v2026.2.2

v2026.2.21

v2026.2.21-beta.1

v2026.2.22

v2026.2.22-beta.1

v2026.2.23

v2026.2.23-beta.1

v2026.2.24

v2026.2.24-beta.1

v2026.2.25

v2026.2.25-beta.1

v2026.2.26

v2026.2.26-beta.1

v2026.2.3

v2026.2.6

v2026.2.6-1

v2026.2.6-2

v2026.2.6-3

v2026.2.9

v2026.3.1

v2026.3.11

v2026.3.11-beta.1

v2026.3.12

v2026.3.13

v2026.3.13-1

v2026.3.2

v2026.3.2-beta.1

v2026.3.22

v2026.3.22-beta.1

v2026.3.23

v2026.3.23-2

v2026.3.23-beta.1

v2026.3.24

v2026.3.24-beta.1

v2026.3.24-beta.2

v2026.3.28

v2026.3.28-beta.1

v2026.3.31

v2026.3.31-beta.1

v2026.3.7

v2026.3.7-beta.1

v2026.3.8

v2026.3.8-beta.1

v2026.4.1

v2026.4.1-beta.1

v2026.4.10

v2026.4.11

v2026.4.11-beta.1

v2026.4.12

v2026.4.12-beta.1

v2026.4.14

v2026.4.14-beta.1

v2026.4.15

v2026.4.15-beta.1

v2026.4.15-beta.2

v2026.4.19-beta.1

v2026.4.19-beta.2

v2026.4.2

v2026.4.25-beta.1

v2026.4.25-beta.10

v2026.4.25-beta.11

v2026.4.25-beta.2

v2026.4.25-beta.3

v2026.4.25-beta.4

v2026.4.25-beta.5

v2026.4.25-beta.6

v2026.4.25-beta.7

v2026.4.25-beta.8

v2026.4.25-beta.9

v2026.4.5

v2026.4.7

v2026.4.7-1

v2026.4.8

v2026.4.9

v2026.4.9-beta.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53809.json"