Which versions of OpenClaw are affected by EUVD-2026-37151?

OpenClaw contains a privilege escalation vulnerability (CVE-2026-53849, CVSS 8.6) where Discord account holders can impersonate authorized privileged users by renaming their accounts, completely…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-37151?

Yes, a public proof-of-concept exploit is available for EUVD-2026-37151. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-37151?

Within 24 hours: Identify all OpenClaw instances using Discord authentication and audit authorization policies for privileged access grants. Review access logs for suspicious account renames or identity assumption attempts. Within 7 days: Implement compensating controls (see below) to enforce identity verification using immutable Discord user IDs. Within 30 days: Establish vendor communication plan for patched version availability; evaluate alternative solutions if patch timeline exceeds organizational risk tolerance.

OpenClaw EUVD-2026-37151

Q: What is the CVSS score of EUVD-2026-37151?

EUVD-2026-37151 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-53849 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-06-16 VulnCheck

GHSA-cw4q-gqg5-g38h

GHSA-p44v-rx83-vjp4

Privilege Escalation Authentication Bypass Openclaw

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Exploitable over Discord (AV:N) with trivial steps (AC:L); attacker needs a Discord account but no OpenClaw privileges (PR:L); impersonation yields high confidentiality and integrity but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:54 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on openclaw (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.7.

DescriptionCVE.org

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

AnalysisAI

Privilege escalation in OpenClaw before 2026.5.7 allows any user with a Discord account to assume the identity of a privileged Discord user authorized in the agent's allowFrom policy by simply renaming their account, because the access-control check matches on mutable display names rather than immutable Discord user IDs (snowflakes). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but exploitation is trivial for anyone who can read the target policy.

Technical ContextAI

OpenClaw is an agent platform whose allowFrom mechanism is intended to restrict which Discord identities may invoke or interact with an agent. The flaw is a classic CWE-290 (Authentication Bypass by Spoofing): the comparator uses the user-controlled display/username string from the Discord profile rather than the immutable snowflake ID that Discord assigns at account creation. Because Discord permits users to change their display name at will, the identity assertion that allowFrom relies on is forgeable by any third party, collapsing the trust model from cryptographic identity to a text label.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.7 or later, in which allowFrom evaluates the immutable Discord user ID (snowflake) rather than the mutable display name; the fix and details are documented in advisory GHSA-cw4q-gqg5-g38h at https://github.com/openclaw/openclaw/security/advisories/GHSA-cw4q-gqg5-g38h. If patching cannot be performed immediately, the most effective compensating control is to rewrite allowFrom policy entries to use Discord user IDs (snowflakes) where the patched logic supports it, or to restrict the agent's exposed Discord channels/servers to closed environments where account creation is moderated; both reduce attack surface but the latter does not eliminate the spoofing window if an authorized member's display name is known. Avoid relying on Discord username uniqueness as an interim control, since legacy discriminator-free usernames and display names can still collide or be impersonated.