CVE-2026-53816

Katalog CVE

CVSS 7.2 · High EPSS 0,50%

Kerentanan Missing Authorization pada openclaw. Skor CVSS 3.1 7.2 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send crafted node.event messages to the gateway, steering target sessions into exec-event paths that expose capabilities the reduced node surface should not provide.

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 40,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6j-hq33-3jv4 mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/openclaw-exec-lifecycle-event-forgery-via-paired-node advisory pihak ketiga