CVE-2026-53809

3.8 Faible

Publiée le 11/06/2026 à 23:16 · Modifiée le 17/06/2026 à 12:58 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	4.8 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	3.8 Faible	disclosure@vulncheck.com	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-863

Références

https://github.com/openclaw/openclaw/security/advisories/GHSA-p39j-x9h5-q66m MitigationVendor Advisory
https://www.vulncheck.com/advisories/openclaw-provider-alias-confusion-in-embedded-runner-policy Third Party Advisory

CVE-2026-53809

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs