CVE-2026-53814

Katalog CVE

CVSS 8.3 · High EPSS 0,39%

Kerentanan Incorrect Privilege Assignment pada openclaw. Skor CVSS 3.1 8.3 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-appropriate scope. Attackers with a valid hook token can exploit the /hooks/agent endpoint to cause spawned CLI runtimes to access or invoke owner-only MCP tools, potentially executing privileged actions like persistent cron state modifications.

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.3 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6fvr-66p3-3qj4 mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-hook-triggered-cli-mcp-tool-authority advisory pihak ketiga