OpenClaw CVE-2026-53854

Exploitation requires two concrete preconditions: first, at least one channel in the target OpenClaw deployment must be configured with a wildcard (*) ownerAllowFrom value - this is the AT:P condition in the CVSS 4.0 vector, and deployments using explicit, channel-scoped ownerAllowFrom values are not affected; second, the attacker must hold authenticated sender access (PR:L) sufficient to submit commands on the internal or webchat paths. Limiting factors include: the wildcard ownerAllowFrom configuration being non-default or uncommon in hardened deployments; the requirement for valid low-privilege credentials; and the attack scope being restricted to the internal and webchat authentication paths only. Unauthenticated parties cannot exploit this flaw per the PR:L requirement in the CVSS 4.0 vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 6.0 and captures the principal risk signals accurately. AV:N and UI:N indicate the attack is fully remote and requires no victim interaction, but PR:L limits exploitation to authenticated senders. The AT:P metric is the most operationally significant qualifier: deployments that do not use wildcard ownerAllowFrom values are not exposed, which substantially narrows the real-world attack surface relative to a generic AV:N/AC:L finding. VI:H reflects the severity of the impact - owner-level command execution across unauthorized channels - but VC:N and VA:N confirm no data exfiltration or service disruption in this attack class. No EPSS data, no CISA KEV listing, and no public POC code were provided or identified, indicating no confirmed widespread or automated exploitation at time of analysis. The practical priority for any given deployment is directly tied to whether wildcard ownerAllowFrom configurations are in use; organizations should audit this setting immediately. No conflicting signals were identified between the CVSS vector and the description.

An authenticated low-privileged user with sender access to an OpenClaw instance where at least one channel has wildcard ownerAllowFrom configured submits commands via the internal or webchat command path. The flawed authorization layer inherits the wildcard owner state from the affected channel and applies it across other channels, causing the attacker's commands to be evaluated as owner-authorized outside their intended scope. No public POC has been identified; successful exploitation requires knowledge of the wildcard configuration and valid sender credentials.