Is there a patch available for CVE-2026-53826?

Yes, a patch is available for CVE-2026-53826. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-53826

Q: What is the CVSS score of CVE-2026-53826?

CVE-2026-53826 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36614 LOW

Exposure of Resource to Wrong Sphere (CWE-668)

2026-06-12 VulnCheck

GHSA-52f4-h455-6w3r

Information Disclosure Openclaw

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

AC:H reflects AT:P attack prerequisites (sandboxed session hierarchy required); PR:L for authenticated low-privilege user; C:L for workspace path disclosure only.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 13, 2026 - 02:00 EUVD

Analysis Generated

Jun 12, 2026 - 22:42 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.26.

DescriptionCVE.org

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to reveal host workspace location or related memory context to child models.

AnalysisAI

Information disclosure in OpenClaw before 2026.4.26 leaks the real host workspace path through sandboxed session spawning, exposing filesystem location and potentially related memory context to child AI model prompts. Authenticated users with low-privilege access can trigger this by spawning child sessions from sandboxed parent sessions, undermining the isolation guarantees of the sandbox environment. With a CVSS 4.0 score of 2.3, no public exploit code, and no CISA KEV listing, this is a low-severity but architecturally meaningful sandbox escape of information relevant to AI agent deployments.

Technical ContextAI

OpenClaw is an AI agent session management framework that supports sandboxed session isolation to prevent child prompts and models from accessing host environment details. The vulnerability is rooted in CWE-668 (Exposure of Resource to Wrong Sphere), where the sandboxed session spawning mechanism incorrectly passes the real workspace path into the child session's context rather than a virtualized or anonymized path. The CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covers all versions prior to 2026.4.26. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) metric confirms that specific deployment conditions - namely, the use of sandboxed parent sessions with child session spawning enabled - must be in place for exploitation.

RemediationAI

The primary fix is to upgrade OpenClaw to version 2026.4.26 or later, which resolves the sandbox isolation failure per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-6c4r-g249-wv3c. If immediate patching is not possible, operators can mitigate by disabling child session spawning from sandboxed parent sessions, though this will reduce agent chaining functionality. Alternatively, restricting low-privilege user accounts from creating sandboxed sessions eliminates the PR:L attack path but may disrupt multi-user workflows. Monitoring session spawn events for unexpected workspace path references in child context can serve as a detection control while patching is arranged.