What is the CVSS score of CVE-2026-53849?

CVE-2026-53849 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-53849?

Yes, a public proof-of-concept exploit is available for CVE-2026-53849. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-53849?

Within 24 hours: Identify all OpenClaw instances using Discord authentication and audit authorization policies for privileged access grants. Review access logs for suspicious account renames or identity assumption attempts. Within 7 days: Implement compensating controls (see below) to enforce identity verification using immutable Discord user IDs. Within 30 days: Establish vendor communication plan for patched version availability; evaluate alternative solutions if patch timeline exceeds organizational risk tolerance.

OpenClaw CVE-2026-53849

Q: Which versions of OpenClaw are affected by CVE-2026-53849?

OpenClaw contains a privilege escalation vulnerability (CVE-2026-53849, CVSS 8.6) where Discord account holders can impersonate authorized privileged users by renaming their accounts, completely…. A patch is available.

EUVD-2026-37151 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-06-16 VulnCheck

GHSA-cw4q-gqg5-g38h

GHSA-p44v-rx83-vjp4

Authentication Bypass Privilege Escalation Openclaw

8.6

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify target OpenClaw agent on Discord
Delivery

Enumerate privileged display name in allowFrom policy
Exploit

Rename attacker Discord account to match
Execution

Send privileged command to agent
Persist

Bypass allowFrom identity check
Impact

Execute actions as impersonated identity

Vulnerability Assessment

Weakness	CWE CWE-290 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Anti-spoofing controls MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The attacker must own any Discord account and be able to message the OpenClaw agent through a channel/DM the agent monitors, and the OpenClaw deployment must use the allowFrom feature with policy entries that reference Discord identities by display name (the default behavior in releases before 2026.5.7). The attacker must also know or guess the display name of a privileged entry in the allowFrom list; deployments that have already migrated policies to user-ID matching, or that do not use allowFrom, are not exploitable. No victim user interaction, no OpenClaw account, and no elevated Discord permissions are required.
Impact	The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is consistent with the described behavior: exploitation is network-reachable through Discord, technically trivial, and yields high confidentiality and integrity impact (the attacker acts as another identity) with no availability impact. PR:L correctly reflects that the attacker needs a working Discord account but no privileges within OpenClaw. There is no EPSS score, SSVC decision, KEV listing, or POC reported in the supplied intelligence, so widespread automated exploitation appears unlikely today; however, the attack requires no special tooling and the policy entries (display names) are often discoverable from public community context, so targeted abuse against known OpenClaw deployments is realistic and should be treated as a real priority rather than a theoretical high-CVSS finding.
Exploit ScenarioDerived	An attacker observes (from public Discord activity, community channels, or leaked configuration) that an OpenClaw agent's allowFrom policy grants access to a Discord identity named, for example, 'admin#OpsLead'. From an unrelated Discord account, the attacker edits their display name to the matching string, sends the privileged command to the agent through Discord, and is authorized as the targeted identity, gaining whatever agent capabilities that policy entry confers. No public exploit identified at time of analysis, but the technique requires only the Discord client UI.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Privilege escalation in OpenClaw before 2026.5.7 allows any user with a Discord account to assume the identity of a privileged Discord user authorized in the agent's allowFrom policy by simply renaming their account, because the access-control check matches on mutable display names rather than immutable Discord user IDs (snowflakes). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but exploitation is trivial for anyone who can read the target policy.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.7 or later, in which allowFrom evaluates the immutable Discord user ID (snowflake) rather than the mutable display name; the fix and details are documented in advisory GHSA-cw4q-gqg5-g38h at https://github.com/openclaw/openclaw/security/advisories/GHSA-cw4q-gqg5-g38h. If patching cannot be performed immediately, the most effective compensating control is to rewrite allowFrom policy entries to use Discord user IDs (snowflakes) where the patched logic supports it, or to restrict the agent's exposed Discord channels/servers to closed environments where account creation is moderated; both reduce attack surface but the latter does not eliminate the spoofing window if an authorized member's display name is known. Avoid relying on Discord username uniqueness as an interim control, since legacy discriminator-free usernames and display names can still collide or be impersonated.

Affected VersionsENISA

OpenClaw 0 <2026.5.7

Affected Packages

npm openclaw fix: 2026.5.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OpenClaw is an agent platform whose allowFrom mechanism is intended to restrict which Discord identities may invoke or interact with an agent. The flaw is a classic CWE-290 (Authentication Bypass by Spoofing): the comparator uses the user-controlled display/username string from the Discord profile rather than the immutable snowflake ID that Discord assigns at account creation. Because Discord permits users to change their display name at will, the identity assertion that allowFrom relies on is forgeable by any third party, collapsing the trust model from cryptographic identity to a text label.

Know when Openclaw gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

vuln.today AI 8.1 HIGH

Exploitable over Discord (AV:N) with trivial steps (AC:L); attacker needs a Discord account but no OpenClaw privileges (PR:L); impersonation yields high confidentiality and integrity but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

DescriptionCVE.org

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on openclaw (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.7.

Executive ViewAI

Why It Matters

OpenClaw contains a privilege escalation vulnerability (CVE-2026-53849, CVSS 8.6) where Discord account holders can impersonate authorized privileged users by renaming their accounts, completely bypassing identity verification controls. No public exploit identified at time of analysis, but exploitation is trivial for anyone reading the authorization policy. This directly compromises administrative access in any organization using OpenClaw's Discord authentication.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Modify all OpenClaw authorization checks to use immutable Discord user IDs (snowflakes) instead of mutable display names; (2) Implement logging and alerting for account rename events correlated with authentication or privileged operations; (3) Require multi-factor authentication for all privileged OpenClaw access; (4) Enforce account naming standards and restrict account rename frequency to reduce attack surface. Affected versions are before 2026.5.7; apply vendor patch immediately when available.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +43

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.