CVE-2026-53809
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy. This allows attackers to compare provider aliases against aliases instead of canonical provider identities, potentially leading to unauthorized access to tools.
Risk Assessment
Organizations may be exposed to unauthorized access to features that should be restricted by provider policies. Exploitation of this vulnerability could lead to serious security breaches.
Recommendation
It is recommended to update OpenClaw to version 2026.4.25 or later to mitigate this vulnerability. Additionally, review and adjust access policies to minimize risk.
Original NVD description (English source)
OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.