CVE-2026-53809 Details
Description
OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.
A policy bypass vulnerability has been identified in OpenClaw versions prior to 2026.4.25. This vulnerability resides in the embedded runner policy, where requests using provider aliases can be incorrectly compared against aliases rather than canonical provider identities. This confusion allows attackers to select bundled tool access that bypasses intended provider policy restrictions, depending on the operator's configuration and the reachability of the affected feature.
Users are advised to update to OpenClaw version 2026.4.25 or later. As a temporary measure, avoid using provider alias routing for embedded runner tool policy until the update can be applied. Keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openclaw/openclaw/security/advisories/GHSA-p39j-x9h5-q66m | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/openclaw-provider-alias-confusion-in-embedded-runner-policy | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.4.25 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | Initial Analysis | [email protected] |
| Jun 11, 2026 | New CVE Received | [email protected] |