Which versions of OpenClaw are affected by CVE-2026-53866?

A critical vulnerability in OpenClaw (CVE-2026-53866) allows authenticated operators to bypass the system's command approval controls and execute unapproved shell commands, directly undermining a key…. A patch is available.

How to fix or mitigate CVE-2026-53866?

Within 24 hours: Inventory all OpenClaw deployments and identify any running versions prior to 2026.5.12; assess which operators hold shell command privileges. Within 7 days: Implement enhanced logging and alerting for all shell command execution from OpenClaw operators; establish temporary multi-person approval workflows outside the application. Within 30 days: Monitor vendor communications for released patches; evaluate compensating control effectiveness; plan upgrade strategy for when a fix becomes available.

OpenClaw CVE-2026-53866

Q: What is the CVSS score of CVE-2026-53866?

CVE-2026-53866 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37168 HIGH

Missing Authorization (CWE-862)

2026-06-16 VulnCheck

GHSA-f397-5vjw-v2c2

GHSA-v383-2wgg-v483

Authentication Bypass Openclaw

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Authenticated operator over the network exploits a parser case missing the allowlist check to run unapproved commands, giving high C and I but no availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:50 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command forms could route through a parser case missing the expected allowlist decision, enabling shell content execution without intended approval prompts.

AnalysisAI

Allowlist bypass in OpenClaw versions prior to 2026.5.12 allows authenticated operators to execute unapproved shell commands by routing requests through inline-command parser cases that skip the expected allowlist enforcement. The flaw, reported by VulnCheck and tracked under GHSA-f397-5vjw-v2c2, effectively neutralizes the operator-approval boundary in OpenClaw's shell command path. No public exploit identified at time of analysis, and the CVSS 4.0 score of 7.6 reflects high confidentiality and integrity impact with a present attack requirement.

Technical ContextAI

OpenClaw (cpe:2.3:a:openclaw:openclaw) implements an allowlist-based authorization layer that gates which shell commands operators may invoke, normally surfacing an approval prompt before execution. The vulnerability is rooted in CWE-862 (Missing Authorization): the parser code path that handles shell inline-command forms - distinct from the conventional command form - lacks the allowlist decision check that is enforced elsewhere. As a result, an authenticated operator who frames their request using an inline-command form reaches the shell execution sink without the policy engine ever evaluating whether the requested command is approved, collapsing the difference between proposed and approved actions.

RemediationAI

Upgrade OpenClaw to version 2026.5.12 or later, which is the vendor-released patch identified in the GitHub Security Advisory GHSA-f397-5vjw-v2c2 (https://github.com/openclaw/openclaw/security/advisories/GHSA-f397-5vjw-v2c2). Where immediate upgrade is not feasible, compensating controls include disabling or blocking the shell inline-command request form at an upstream proxy or API gateway so only the conventional command form (which is correctly gated by the allowlist) reaches OpenClaw - accepting that operators lose inline-command ergonomics - and tightening operator account provisioning so only highly trusted users hold the operator role until patched, with audit logging on every shell command invocation to detect attempts to invoke non-allowlisted commands. Review operator command history since deployment for evidence of inline-command forms invoking commands outside the configured allowlist.