Which versions of OpenClaw are affected by EUVD-2026-37159?

OpenClaw versions before 2026.5.3 contain an authentication bypass that allows users with low privileges to intercept agent responses intended for other users by manipulating their display name.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-37159?

Yes, a public proof-of-concept exploit is available for EUVD-2026-37159. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-37159?

Within 24 hours: Identify all OpenClaw installations and document current versions; implement audit logging on agent response requests and display name modifications. Within 7 days: Contact OpenClaw vendor for patch ETA; restrict OpenClaw access to essential users only; disable or isolate non-critical agent response features. Within 30 days: Apply patched version 2026.5.3 or later when available; validate patch in staging environment before production deployment; conduct log review for indicators of unauthorized agent response access.

OpenClaw EUVD-2026-37159

Q: What is the CVSS score of EUVD-2026-37159?

EUVD-2026-37159 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-53857 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-06-16 VulnCheck

GHSA-8c59-hr4w-qg69

GHSA-w7m7-3xcf-mp48

Authentication Bypass Openclaw

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Attacker needs a Zalo account to send messages (PR:L), abuse is network-reachable and low-complexity, and impersonation discloses and alters agent responses (C:H/I:H) without availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:52 vuln.today

DescriptionCVE.org

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.

AnalysisAI

Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses intended for other Zalo identities by manipulating their mutable display name to match allowFrom policy entries. The flaw stems from policy enforcement relying on mutable display metadata rather than immutable identifiers, and no public exploit has been identified at time of analysis.

Technical ContextAI

OpenClaw integrates with Zalo (a popular Vietnamese messaging platform) and enforces agent-response routing through an allowFrom policy that whitelists permitted senders. The implementation matches incoming Zalo contacts against allowFrom entries using display name metadata, which Zalo users can freely change. This is a textbook CWE-290 (Authentication Bypass by Spoofing) issue: a security decision is anchored to an attacker-controllable attribute instead of an immutable identity claim such as a stable user ID or cryptographic credential.

RemediationAI

Vendor-released patch: OpenClaw 2026.5.3 - upgrade per the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-8c59-hr4w-qg69. Until the upgrade is applied, operators can disable the Zalo allowFrom feature entirely (which removes the bypass at the cost of losing per-sender allowlist routing), or rewrite allowFrom entries to reference immutable Zalo user IDs rather than display names where the configuration supports it (trade-off: requires inventorying and translating existing policies, and is only effective if the underlying matcher honors stable identifiers). Network-layer mitigations are not effective here because the abuse occurs inside an authorized Zalo session.