CVE-2026-53847
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile — higher than 7% of all known CVEs
Summary
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges.
Risk Assessment
Attackers with operator.write access can exploit insufficient scope validation to apply unauthorized configuration changes, potentially leading to serious security breaches.
Recommendation
It is recommended to update OpenClaw to version 2026.5.6 or later to mitigate this vulnerability and review operator permissions within the system.
Original NVD description (English source)
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficient scope validation to apply unauthorized configuration changes beyond the intended write scope.