CVE-2026-53811 Details

A privilege escalation vulnerability has been identified in OpenClaw versions prior to 2026.5.7. The issue resides in the Matrix allowFrom feature, where authenticated users can exploit mutable display name metadata to match policy entries. This vulnerability allows users who can change their display names to gain agent access intended for another Matrix identity, potentially acquiring unauthorized permissions based on the operator's configuration.

Users are advised to update to OpenClaw version 2026.5.7 or later. As a temporary measure, use stable Matrix user IDs in allowlists until the update is applied. For general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when not needed.