CVE-2026-53809

OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

CVSS 4.8 MEDIUMEPSS 0.1%CWE-863

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 4.8EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

11 jun 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Productos afectados

OpenClaw · OpenClaw

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/openclaw/openclaw/security/advisories/GHSA-p39j-x9h5-q66m https://www.vulncheck.com/advisories/openclaw-provider-alias-confusion-in-embedded-runner-policy