Which versions of OpenClaw are affected by CVE-2026-53836?

OpenClaw versions before 2026.5.12 contain a critical remote code execution vulnerability allowing authenticated operators to bypass PowerShell execution controls and execute arbitrary commands with…. A patch is available.

How to fix or mitigate CVE-2026-53836?

24 hours: Inventory all OpenClaw deployments and document current versions. 7 days: Apply least-privilege access controls to operator accounts and enable PowerShell Script Block Logging for command auditing. 30 days: Monitor vendor communications for patch release (version 2026.5.12 or later) and prepare deployment testing procedures.

OpenClaw CVE-2026-53836

Q: What is the CVSS score of CVE-2026-53836?

CVE-2026-53836 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-36624 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-06-12 VulnCheck

GHSA-ffhm-8fwq-7q27

GHSA-j472-gf56-x589

RCE Openclaw

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable operator API, low complexity alias trick, requires authenticated operator (PR:L), no user interaction, full host RCE impact on C/I/A within the OpenClaw service scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 13, 2026 - 02:00 EUVD

Analysis Generated

Jun 12, 2026 - 22:36 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks by using unrecognized encoded-command alias forms to execute arbitrary PowerShell content.

AnalysisAI

Remote code execution in OpenClaw before 2026.5.12 allows authenticated operators to bypass the PowerShell execution allowlist by submitting encoded-command flag aliases (abbreviated forms) that the allowlist parser fails to recognize. The flaw enables execution of arbitrary PowerShell payloads with full confidentiality, integrity, and availability impact on the host. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

OpenClaw (cpe:2.3:a:openclaw:openclaw:*) implements an allowlist parser that gates which PowerShell invocations may be executed by operators. The root cause is CWE-184 (Incomplete List of Disallowed Inputs): the parser normalizes only the canonical -EncodedCommand flag but does not enumerate or canonicalize the abbreviated PowerShell aliases (e.g. -enc, -encodedc, -e) that powershell.exe natively accepts. Because PowerShell resolves any unambiguous prefix of a parameter name, the engine still consumes the base64-encoded payload while the allowlist treats the alias as an unknown/benign token, producing an authorization-bypass primitive.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.12 or later, which extends the allowlist parser to canonicalize abbreviated PowerShell flag aliases; see GHSA-j472-gf56-x589 for the upstream fix. Until the upgrade can be deployed, restrict operator role assignment to a minimum trusted set and audit existing operator accounts for unexpected use of -enc/-encodedc style arguments, accepting that this is detective rather than preventive. As a stronger compensating control, disable or proxy the PowerShell execution feature entirely, or front it with an external policy engine that normalizes parameter names before allowlist evaluation - the trade-off is loss of legitimate automation that depends on PowerShell tasks until the patch is applied.