CVE-2026-53839

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1023

Affected software

Vendor	Product	Versions
OpenClaw	OpenClaw	< 2026.5.7

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-77q5-rr5v-x43qMitigation, Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-hostname-prefix-matching-bypass-in-trusted-retry-endpoint-validationThird Party Advisory

Timeline

Published: Jun 12, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-53845.8An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved CVE-2026-538407.1OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured CVE-2026-538416.1OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data:CVE-2026-538427.1OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime CVE-2026-538438.8OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish no CVE-2026-538446.5OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers CVE-2026-538454.3OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-too CVE-2026-538467.1OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm CVE-2026-538475.4OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with o CVE-2026-538484.3OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side eff CVE-2026-538498.1OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account iden CVE-2026-53858.4An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi