Is there a patch available for CVE-2026-53839?

Yes, a patch is available for CVE-2026-53839. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-53839

Q: What is the CVSS score of CVE-2026-53839?

CVE-2026-53839 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36627 MEDIUM

Incomplete Comparison with Missing Factors (CWE-1023)

2026-06-12 VulnCheck

GHSA-wcpv-6hg7-mfcc

Information Disclosure Openclaw

6.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable but attacker must control a prefix-matched hostname (AC:H); low-privilege auth required (PR:L); only authentication material confidentiality is impacted (C:H, I:N, A:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 13, 2026 - 02:00 EUVD

Analysis Generated

Jun 12, 2026 - 22:46 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on openclaw (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.7.

DescriptionCVE.org

OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.

AnalysisAI

OpenClaw's retry endpoint authentication check performs hostname prefix matching instead of exact hostname comparison, enabling an authenticated attacker to redirect sensitive authentication material to an attacker-controlled endpoint. All versions before 2026.5.7 are affected per CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*. The CVSS 4.0 vector scores this at 6.0 with high confidentiality impact (VC:H) and a specific attack prerequisite (AT:P); no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The vulnerability stems from CWE-1023 (Incomplete Comparison Using Substring or Prefix), a logic flaw in which a security-relevant comparison uses substring or prefix matching rather than strict equality. In OpenClaw's retry endpoint validation, the hostname of a candidate retry target is checked against a trusted-host allowlist using a prefix-based comparison - meaning any hostname that begins with a trusted hostname string will pass validation. This is conceptually equivalent to checking if 'trusted-host' is a prefix of the request target rather than confirming an exact, case-sensitive match. The affected protocol surface involves authentication material forwarding during retry logic, which is a common pattern in distributed or fault-tolerant systems; when such material is misdirected, it constitutes credential leakage. All OpenClaw releases before 2026.5.7 carry this flaw according to the CPE wildcard entry and the version boundary stated in the description.

RemediationAI

The primary fix is to upgrade OpenClaw to version 2026.5.7 or later, which corrects the hostname comparison logic to require exact matches in retry endpoint trust validation. The vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-77q5-rr5v-x43q should be consulted for upgrade instructions. If an immediate upgrade is not feasible, operators should audit their trusted-hostname allowlists and ensure no hostname in the list could plausibly be a prefix of an attacker-controllable domain (e.g., if 'api.internal' is trusted, an attacker-owned 'api.internal.evil.com' would bypass the check). As a compensating control, restrict outbound network access from the OpenClaw service to only the explicitly expected trusted endpoints at the network layer (firewall or egress policy), which would block misdirected authentication material from reaching attacker infrastructure even if the prefix check passes. This control does not eliminate the vulnerability but reduces the impact until a patch can be applied.