Is there a patch available for CVE-2026-53808?

Yes, a patch is available for CVE-2026-53808. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-53808

Q: What is the CVSS score of CVE-2026-53808?

CVE-2026-53808 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36314 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-11 VulnCheck

GHSA-hg6q-r8c9-2xj5

Authentication Bypass Openclaw

6.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

AC:H reflects the AT:P condition (pending workflow must exist); PR:N per vendor vector; integrity-only impact with no confidentiality or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 21:34 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.6.

DescriptionCVE.org

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true despite approvalPolicy: pending configuration. Attackers can exploit this by reaching the affected apply path to apply workshop changes before the expected approval step, potentially modifying configurations without proper authorization.

AnalysisAI

Approval policy bypass in OpenClaw's Skill Workshop apply flow allows remote attackers to apply workshop configuration changes without completing the required authorization step. Versions prior to 2026.5.6 fail to enforce the approvalPolicy: pending gate when agent tool calls include apply: true, effectively granting unauthorized write access to skill configurations. No public exploit code has been identified at time of analysis; a vendor-released patch is available.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) implements an approval workflow in its Skill Workshop feature, where configuration changes are gated by an approvalPolicy: pending state before being applied. The root cause is CWE-863 (Incorrect Authorization): the apply endpoint evaluates authorization against an incorrect condition or in the wrong order, allowing agent tool calls that explicitly set apply: true to short-circuit the pending approval gate. This is a logic-layer authorization failure rather than a missing authentication control - the system has an approval mechanism but it can be bypassed via a specific code path.

RemediationAI

Upgrade to OpenClaw version 2026.5.6 or later, which contains the vendor-released patch for this approval policy bypass. The fix is documented in the GitHub security advisory GHSA-cqwv-9qjx-vxw2 at https://github.com/openclaw/openclaw/security/advisories/GHSA-cqwv-9qjx-vxw2. If immediate patching is not feasible, consider network-layer restrictions to limit access to the Skill Workshop apply endpoint to trusted internal hosts only, trading off external accessibility for reduced attack surface. Disabling agent tool call access to the apply path is another targeted compensating control, though this will disrupt automated workflow integrations. Temporarily disabling the Skill Workshop feature entirely eliminates the vulnerability but removes change management functionality. Audit apply-path activity logs for any historical instances of apply: true submissions that bypassed pending approval states.