CVE-2026-53836
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
OpenClaw before version 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling. Attackers can exploit abbreviated flag aliases not recognized by the allowlist parser to execute arbitrary PowerShell content.
Risk Assessment
This vulnerability allows remote authenticated operators to bypass execution allowlist checks, potentially leading to the execution of malicious code on the system. Organizations may be at risk of unauthorized actions and data loss.
Recommendation
It is recommended to update OpenClaw to version 2026.5.12 or later to mitigate this vulnerability. Additionally, conducting a security audit is advisable to minimize risks associated with unauthorized access.
Original NVD description (English source)
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks by using unrecognized encoded-command alias forms to execute arbitrary PowerShell content.