Is there a patch available for EUVD-2026-37153?

Yes, a patch is available for EUVD-2026-37153. Update the affected software to the latest version immediately.

OpenClaw EUVD-2026-37153

Q: What is the CVSS score of EUVD-2026-37153?

EUVD-2026-37153 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-53851 MEDIUM

Missing Authorization (CWE-862)

2026-06-16 VulnCheck

GHSA-c8w7-9w9h-x69q

GHSA-fcvx-5cxc-v5p8

Authentication Bypass Openclaw

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AC:H reflects the required prerequisite configuration (Slack integration active, reaction notifications disabled); PR:N because Slack workspace access - not system credentials - is the only requirement; I:L only for unauthorized agent input processing with no confidentiality or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 19:04 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.

AnalysisAI

OpenClaw before 2026.5.12 fails to enforce its own notification filter for Slack reaction events, allowing those events to bypass a disabled-notification setting and reach the agent processing pipeline (CWE-862: Missing Authorization). Any user with Slack workspace access can send reaction events to channels monitored by OpenClaw, triggering unintended agent execution with lower-trust input even when administrators have explicitly disabled reaction notifications. No public exploit code exists and no active exploitation has been confirmed at time of analysis; the CVSS 4.0 score of 6.3 reflects a moderate-severity, narrow-impact integrity issue.

Technical ContextAI

OpenClaw is an AI agent framework that integrates with Slack as an event source. It maintains a configuration flag to enable or disable processing of Slack reaction events (emoji reactions to messages). Due to CWE-862 (Missing Authorization), the enforcement gate that should halt reaction events from entering the agent pipeline is absent or ineffective when the feature is toggled off, meaning the disable setting is honored only at the UI/configuration layer and not enforced at the pipeline ingestion layer. The affected product is identified by CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, covering all versions prior to 2026.5.12. The CVSS 4.0 vector AT:P (Attack Target: Presence) reflects that exploitation depends on the Slack integration being active within the deployment.

RemediationAI

Upgrade OpenClaw to version 2026.5.12 or later, which is the fix version identified in the CVE description and referenced in the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8. If an immediate upgrade is not feasible, consider disabling the Slack integration entirely within the OpenClaw configuration - this eliminates the attack surface but removes all Slack-driven agent functionality. As a second-tier control, restricting Slack workspace membership to fully trusted internal users limits the pool of potential abusers, though it does not close the underlying authorization gap. Neither workaround substitutes for patching; both carry operational trade-offs that should be weighed against the deployment's threat model.