CVE-2026-53866 Details
Description
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command forms could route through a parser case missing the expected allowlist decision, enabling shell content execution without intended approval prompts.
A vulnerability allowing allowlist bypass in shell inline-command parsing has been identified in OpenClaw versions prior to 2026.5.12. This vulnerability enables authenticated operators to execute unapproved commands. The issue arises because command requests using shell inline-command forms can pass through a parser case that lacks the necessary allowlist validation, allowing shell content execution without the intended approval prompts.
Users are advised to require approval for shell inline-command forms until the application is updated to version 2026.5.12 or later. As a general hardening measure, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openclaw/openclaw/security/advisories/GHSA-f397-5vjw-v2c2 | [email protected] | Vendor Advisory |
| https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-in-shell-inline-command-parsing | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.5.12 2026.5.12 beta1 2026.5.12 beta2 2026.5.12 beta3 2026.5.12 beta4 2026.5.12 beta5 2026.5.12 beta6 2026.5.12 beta7 2026.5.12 beta8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | New CVE Received | [email protected] |