Medium
OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands
Type: advisorySources: OSV
OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries. Attackers can exploit this by sending commands on affected internal or webchat paths to execute owner-style command behavior outside intended channel scope, potentially bypassing access controls.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-53854
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:05 UTC · Revision 1
Source evidence
OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands
core-osv · Original sourcePublished 16 Jun 2026, 18:05 UTC
OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries. Attackers can exploit this by sending commands on affected internal or webchat paths to execute owner-style command behavior outside intended channel scope, potentially bypassing access controls.
osv:CVE-2026-53854
Complete source record
{
"id": "074cf87f7a663e84417ca72698f6e9dd376520cd9ab048149bc0bab2737fa6c8",
"url": "https://osv.dev/vulnerability/CVE-2026-53854",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands",
"summary": "OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries. Attackers can exploit this by sending commands on affected internal or webchat paths to execute owner-style command behavior outside intended channel scope, potentially bypassing access controls.",
"evidence": "osv:CVE-2026-53854",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-53854",
"aliases": [
"CVE-2026-53854",
"GHSA-4hpg-mp64-x7xq"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openclaw/openclaw",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "aa36ee670b76211426a2e89a84e9096453c01ee7"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2026.4.25"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2026.4.25"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2026.4.25-beta.11",
"v2026.4.25-beta.10",
"v2026.4.25-beta.9",
"v2026.4.25-beta.8",
"v2026.4.25-beta.7",
"v2026.4.25-beta.6",
"v2026.4.25-beta.5",
"v2026.4.25-beta.4",
"v2026.4.25-beta.3",
"v2026.4.25-beta.2",
"v2026.4.25-beta.1",
"v2026.4.19-beta.2",
"v2026.4.19-beta.1",
"v2026.4.15",
"v2026.4.15-beta.2",
"v2026.4.15-beta.1",
"v2026.4.14",
"v2026.4.14-beta.1",
"v2026.4.12",
"v2026.4.12-beta.1",
"v2026.4.11",
"v2026.4.11-beta.1",
"v2026.4.10",
"v2026.4.9",
"v2026.4.9-beta.1",
"v2026.4.8",
"v2026.4.7-1",
"v2026.4.7",
"v2026.4.5",
"v2026.4.2",
"v2026.4.1",
"v2026.4.1-beta.1",
"v2026.3.31",
"v2026.3.31-beta.1",
"v2026.3.28",
"v2026.3.28-beta.1",
"v2026.3.24",
"v2026.3.24-beta.2",
"v2026.3.24-beta.1",
"v2026.3.23-2",
"v2026.3.23",
"v2026.3.23-beta.1",
"v2026.3.22",
"v2026.3.22-beta.1",
"v2026.3.13-1",
"v2026.3.13",
"v2026.3.12",
"v2026.3.11",
"v2026.3.11-beta.1",
"v2026.3.8",
"v2026.3.8-beta.1",
"v2026.3.7",
"v2026.3.7-beta.1",
"v2026.3.2-beta.1",
"v2026.3.2",
"v2026.3.1",
"v2026.2.26",
"v2026.2.26-beta.1",
"v2026.2.25",
"v2026.2.25-beta.1",
"v2026.2.24",
"v2026.2.24-beta.1",
"v2026.2.23",
"v2026.2.23-beta.1",
"v2026.2.22",
"v2026.2.22-beta.1",
"v2026.2.21",
"v2026.2.21-beta.1",
"v2026.2.19-beta.1",
"v2026.2.19",
"v2026.2.17",
"v2026.2.15-beta.1",
"v2026.2.14",
"v2026.2.13",
"v2026.2.12",
"v2026.2.9",
"v2026.2.6-3",
"v2026.2.6-2",
"v2026.2.6-1",
"v2026.2.6",
"v2026.2.3",
"v2026.2.2",
"v2026.2.1",
"v2026.1.30",
"v2026.1.29",
"v2026.1.24-1",
"v2026.1.24",
"v2026.1.23",
"v2026.1.22",
"v2026.1.21",
"v2026.1.20",
"v2026.1.16-2",
"v2026.1.15",
"v2026.1.14-1",
"v2026.1.13",
"v2026.1.12-2",
"v2026.1.12",
"v2026.1.11-3",
"v2026.1.11-2",
"v2026.1.11-1",
"v2026.1.11",
"v2026.1.10",
"v2026.1.9",
"v2026.1.8",
"v2026.1.5-3",
"v2026.1.5-2",
"v2026.1.5-1",
"v2026.1.5",
"v2.0.0-beta5",
"v2.0.0-beta4",
"v2.0.0-beta3",
"v2.0.0-beta2",
"v2.0.0-beta1",
"v1.3.0",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.0",
"v1.0.4",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53854.json"
}
}
],
"modified": "2026-10-28T02:30:23.164039929Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53854.json",
"https://github.com/openclaw/openclaw/security/advisories/GHSA-4hpg-mp64-x7xq",
"https://nvd.nist.gov/vuln/detail/CVE-2026-53854",
"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-ownerallowfrom-wildcard-inheritance-in-internal-webchat-commands",
"https://github.com/openclaw/openclaw"
],
"provider_metadata": {
"cwe_ids": [
"CWE-863"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53854.json"
}
},
"related_cves": [
{
"value": "CVE-2026-53854",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489629,
"published_at": "2026-06-16T18:05:03.008+00:00"
}