OpenClaw CVE-2026-53859

Exploitation requires a valid authenticated session in OpenClaw (confirmed by PR:L in the CVSS 4.0 vector) with the ability to supply or influence model-derived or workspace-derived URLs - this is the specific attack surface named in the CVE description. The operator must have configured an active hostname blocklist policy; deployments with no blocklist have nothing to bypass and are not exposed. The CVSS 4.0 AT:P metric confirms that both conditions - attacker-controlled URL input and an enforced blocklist - must be present simultaneously. Exploitation is limited strictly to confidentiality impact (access to blocked network destinations); the CVSS vector confirms no integrity (VI:N) or availability (VA:N) impact is achievable. Subsequent-system impact is also None (SC:N/SI:N/SA:N), scoping the blast radius to data readable from the bypassed destination. Deployments where end users cannot define URL parameters, or where no blocklist policies are enforced, are not meaningfully at risk.

The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N positions this as a medium-severity finding despite a High confidentiality rating. The PR:L metric confirms exploitation requires an authenticated session, and AT:P introduces a further prerequisite: both an operator-configured blocklist and attacker control over URL parameters must exist simultaneously. The High confidentiality impact (VC:H) suggests that successful exploitation can expose sensitive data from blocked internal or protected destinations - consistent with a server-side request forgery (SSRF)-style abuse pattern. No integrity or availability impact is present per the CVSS vector. EPSS data is absent from available intelligence, so quantitative exploitation probability cannot be established. No KEV listing and no public POC have been identified, indicating no confirmed active exploitation at time of analysis. Real-world priority is moderate: multi-tenant or enterprise deployments with strict blocklist policies and user-controlled URL inputs are meaningfully exposed; single-user or no-blocklist deployments are not.

An authenticated OpenClaw user who can specify model- or workspace-derived URL targets identifies that internal-api.corp.example.com is on the operator's blocklist. The attacker submits the URL internal-api.corp.example.com. (with trailing dot); the blocklist comparison fails to match the modified string against the blocked entry and permits the outbound request, which DNS resolves to the same address as the blocked host. The attacker then retrieves confidential data from the previously restricted internal endpoint. No public POC has been identified at time of analysis, though the trailing-dot SSRF bypass technique is well documented in security research literature.