Is there a patch available for CVE-2026-53820?

Yes, a patch is available for CVE-2026-53820. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-53820

Q: What is the CVSS score of CVE-2026-53820?

CVE-2026-53820 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36608 MEDIUM

Missing Authorization (CWE-862)

2026-06-12 VulnCheck

GHSA-jxfq-h7pm-67ph

Authentication Bypass Openclaw

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

Local attack vector and low privileges confirmed by loopback path; high integrity from unrestricted command execution; no scope change as subsequent systems are unaffected.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 13, 2026 - 02:00 EUVD

Analysis Generated

Jun 12, 2026 - 22:41 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled MCP session-spawn path to start sessions with broader command reach than intended.

AnalysisAI

OpenClaw's bundled MCP loopback session-spawn path fails to enforce its exec denylist, allowing authenticated low-privilege callers to execute commands that should be restricted. Affected versions are all OpenClaw releases prior to 2026.5.12. An attacker with local, authenticated access can spawn MCP sessions through the loopback path to gain command reach exceeding their authorized scope, resulting in high integrity impact on the vulnerable system. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) implements the Model Context Protocol (MCP), an AI tool-integration protocol that allows clients to invoke server-side capabilities including process execution. The bundled MCP component exposes a loopback session-spawn path - a local interface used to instantiate new MCP sessions. This path is supposed to honor an exec denylist that restricts which commands can be run. CWE-862 (Missing Authorization) identifies the root cause: the session-spawn code path does not re-validate or enforce the denylist when spawning sessions via the loopback mechanism, effectively creating an authorization gap between what the denylist intends to block and what the loopback path actually permits. The CVSS 4.0 vector (AV:L) confirms exploitation requires local system access, consistent with a loopback-bound interface.

RemediationAI

Upgrade to OpenClaw 2026.5.12 or later, which resolves the exec denylist bypass in the bundled MCP loopback session-spawn path per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-qh2f-99mv-mrcf. If immediate patching is not possible, restrict local system access to only trusted, authorized users who require OpenClaw functionality, reducing the pool of callers who could reach the loopback session-spawn path. Additionally, consider disabling or isolating the bundled MCP session-spawn feature if it is not required by your deployment - note that this may break MCP-dependent integrations. Audit local accounts and service credentials with access to the OpenClaw process to enumerate who could currently exploit this path.