EUVD-2026-37159
GHSA-8c59-hr4w-qg69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify allowFrom display name target
-
DeliveryRename attacker Zalo account to match
-
ExploitInitiate Zalo session with OpenClaw agent
-
ExecutionPolicy matches display name
-
ImpactReceive responses intended for victim identity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the target OpenClaw instance to be running a version earlier than 2026.5.3 with the Zalo integration enabled and at least one allowFrom policy entry referencing a display-name-based identity, (2) the attacker to possess a Zalo account they can rename to match that entry, and (3) the attacker to be able to send messages to the OpenClaw agent over Zalo (consistent with CVSS PR:L, indicating an authenticated Zalo user rather than fully unauthenticated network access). Exploitation is limited where the Zalo feature is disabled, where allowFrom entries are bound to immutable Zalo IDs, or where the targeted display name is uniquely controlled and cannot be replicated. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6, reflecting network-reachable, low-complexity exploitation by an authenticated Zalo user with high confidentiality and integrity impact but no availability impact, which is consistent with policy bypass leading to message hijacking rather than service disruption. There is no CISA KEV listing, no EPSS score provided, and no public POC referenced - only a GitHub Security Advisory (GHSA-8c59-hr4w-qg69) and a VulnCheck writeup - so this is best treated as a credible but unproven-in-the-wild policy bypass. Real-world risk is meaningful for any deployment that has the Zalo allowFrom feature enabled, but limited where the feature is off or where operators rely on stable Zalo IDs rather than display names; SSVC/EPSS automation signals are absent and should be re-evaluated once available. |
| Exploit ScenarioDerived | An attacker with their own Zalo account changes their display name to match an entry in a target OpenClaw deployment's allowFrom policy, then messages the OpenClaw agent over Zalo. Because policy matching keys on the mutable display name, the attacker's session is treated as the privileged identity and receives agent responses meant for that other Zalo user, enabling impersonation and disclosure of sensitive replies. No public POC is referenced, but the technique is straightforward to reproduce given Zalo's standard display-name change UI. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses intended for other Zalo identities by manipulating their mutable display name to match allowFrom policy entries. The flaw stems from policy enforcement relying on mutable display metadata rather than immutable identifiers, and no public exploit has been identified at time of analysis.
RemediationAI
Vendor-released patch: OpenClaw 2026.5.3 - upgrade per the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-8c59-hr4w-qg69. Until the upgrade is applied, operators can disable the Zalo allowFrom feature entirely (which removes the bypass at the cost of losing per-sender allowlist routing), or rewrite allowFrom entries to reference immutable Zalo user IDs rather than display names where the configuration supports it (trade-off: requires inventorying and translating existing policies, and is only effective if the underlying matcher honors stable identifiers). Network-layer mitigations are not effective here because the abuse occurs inside an authorized Zalo session.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw integrates with Zalo (a popular Vietnamese messaging platform) and enforces agent-response routing through an allowFrom policy that whitelists permitted senders. The implementation matches incoming Zalo contacts against allowFrom entries using display name metadata, which Zalo users can freely change. This is a textbook CWE-290 (Authentication Bypass by Spoofing) issue: a security decision is anchored to an attacker-controllable attribute instead of an immutable identity claim such as a stable user ID or cryptographic credential.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Attacker needs a Zalo account to send messages (PR:L), abuse is network-reachable and low-complexity, and impersonation discloses and alters agent responses (C:H/I:H) without availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.
Executive ViewAI
OpenClaw versions before 2026.5.3 contain an authentication bypass that allows users with low privileges to intercept agent responses intended for other users by manipulating their display name. This creates direct exposure of sensitive agent communications and potential access to other users' data, posing confidentiality and compliance risks. All OpenClaw deployments require immediate version assessment and interim access controls pending patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict authorization logic to immutable user identifiers rather than mutable display names; (2) Implement mandatory audit logging and alerting for all agent response requests with detailed user identification; (3) Limit agent response features to trusted internal operations only; (4) Require manual approval for agent responses containing sensitive data; (5) Segment OpenClaw network access and monitor for suspicious display name pattern activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB