CVE-2026-53829

HighCVSS 8.0/10Last modified Jul 23, 2026

Description

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-451

Affected software

Vendor	Product	Versions
OpenClaw	OpenClaw	< 2026.5.18

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-xww8-gqvh-92x9Mitigation, Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-command-truncation-in-exec-approval-displayThird Party Advisory

Timeline

Published: Jun 12, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-53834.4An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance CVE-2026-538306.5OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets CVE-2026-538318.1OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansio CVE-2026-538327.1OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy ident CVE-2026-538336.5OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to CVE-2026-538346.5OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated send CVE-2026-538354.3OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that allows authenticate CVE-2026-538368.8OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute CVE-2026-538375.3OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type CVE-2026-538389.8OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval CVE-2026-538396.5OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instea CVE-2026-53845.8An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved