Which versions of OpenClaw are affected by CVE-2026-53865?

OpenClaw versions before 2026.5.2 contain a local privilege escalation vulnerability enabling authenticated users to execute arbitrary code with elevated privileges by manipulating system paths…. A patch is available.

Is there a public PoC exploit available for CVE-2026-53865?

Yes, a public proof-of-concept exploit is available for CVE-2026-53865. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-53865?

Within 24 hours: Identify and inventory all systems running OpenClaw before 2026.5.2; assess exposure scope to local users with system access. Within 7 days: Restrict local access to affected systems to administrators only and enable comprehensive logging of maintenance task execution. Within 30 days: Monitor for OpenClaw 2026.5.2 or later patch release and prepare staged deployment plan.

OpenClaw CVE-2026-53865

Q: What is the CVSS score of CVE-2026-53865?

CVE-2026-53865 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-37167 HIGH

Untrusted Search Path (CWE-426)

2026-06-16 VulnCheck

GHSA-2w22-3f6x-3hf4

GHSA-rx78-29qr-5hq8

Path Traversal Openclaw

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Local low-priv user must influence workspace env and win path resolution against a maintenance run (AC:H, PR:L); yields code execution (C:H/I:H) without availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:50 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.2.

DescriptionCVE.org

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by manipulating workspace-derived environment paths.

AnalysisAI

Untrusted search path execution in OpenClaw before 2026.5.2 allows a local low-privileged user to coerce maintenance task routines into invoking attacker-controlled executables in place of the intended trash command. By manipulating workspace-derived environment paths consumed during maintenance operations, an authenticated user can hijack command resolution and run arbitrary binaries in the OpenClaw process context. No public exploit identified at time of analysis, but VulnCheck has published a dedicated advisory describing the workspace-derived service path abuse.

Technical ContextAI

OpenClaw resolves the executable for its trash/cleanup command during maintenance task execution by consulting environment paths derived from the user-controlled workspace rather than a hardened, absolute path. This matches CWE-426 (Untrusted Search Path): the program trusts a lookup path whose entries can be influenced by an attacker, so the OS loader picks up a malicious binary that shadows the legitimate one. The CPE cpe:2.3:a:openclaw:openclaw covers all versions of the OpenClaw application up to the 2026.5.2 fix line, and the affected code path is the maintenance/trash subsystem that performs file cleanup using shell-style command name resolution instead of explicit binary paths.

RemediationAI

Vendor-released patch: OpenClaw 2026.5.2 - upgrade to this version or later, per the GHSA-rx78-29qr-5hq8 advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-rx78-29qr-5hq8. Until the upgrade is deployed, restrict who can create or modify OpenClaw workspaces so untrusted users cannot influence the environment variables that feed the maintenance task's service path (this limits multi-user collaboration features). As an additional compensating control, run OpenClaw maintenance tasks under a hardened PATH (absolute system directories only) and remove writable directories from the inherited environment before invoking maintenance operations, accepting that any maintenance hook that depended on workspace-relative tooling will need explicit absolute paths. VulnCheck's writeup at https://www.vulncheck.com/advisories/openclaw-arbitrary-command-execution-via-workspace-derived-service-path provides further detection guidance.