Medium
OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope
Type: advisorySources: OSV
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficient scope validation to apply unauthorized configuration changes beyond the intended write scope.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-53847
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 19:53 UTC · Revision 1
Source evidence
OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope
core-osv · Original sourcePublished 16 Jun 2026, 18:04 UTC
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficient scope validation to apply unauthorized configuration changes beyond the intended write scope.
osv:CVE-2026-53847
Complete source record
{
"id": "58da62ee0fd93c45b49d24790ddf7361be3c4de3fa6aadd65ef0e088547fa9fb",
"url": "https://osv.dev/vulnerability/CVE-2026-53847",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope",
"summary": "OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficient scope validation to apply unauthorized configuration changes beyond the intended write scope.",
"evidence": "osv:CVE-2026-53847",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-53847",
"aliases": [
"CVE-2026-53847",
"GHSA-x629-46cc-7xgw"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openclaw/openclaw",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "c97b9f79ec43b531a3472c3219ca51efbf7695a3"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2026.5.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2026.5.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2026.5.5",
"v2026.5.5-beta.2",
"v2026.5.5-beta.1",
"v2026.5.4",
"v2026.5.4-beta.3",
"v2026.5.4-beta.2",
"v2026.4.19-beta.2",
"v2026.4.19-beta.1",
"v2026.4.15",
"v2026.4.15-beta.2",
"v2026.4.15-beta.1",
"v2026.4.14",
"v2026.4.14-beta.1",
"v2026.4.12",
"v2026.4.12-beta.1",
"v2026.4.11",
"v2026.4.11-beta.1",
"v2026.4.10",
"v2026.4.9",
"v2026.4.9-beta.1",
"v2026.4.8",
"v2026.4.7-1",
"v2026.4.7",
"v2026.4.5",
"v2026.4.2",
"v2026.4.1",
"v2026.4.1-beta.1",
"v2026.3.31",
"v2026.3.31-beta.1",
"v2026.3.28",
"v2026.3.28-beta.1",
"v2026.3.24",
"v2026.3.24-beta.2",
"v2026.3.24-beta.1",
"v2026.3.23-2",
"v2026.3.23",
"v2026.3.23-beta.1",
"v2026.3.22",
"v2026.3.22-beta.1",
"v2026.3.13-1",
"v2026.3.13",
"v2026.3.12",
"v2026.3.11",
"v2026.3.11-beta.1",
"v2026.3.8",
"v2026.3.8-beta.1",
"v2026.3.7",
"v2026.3.7-beta.1",
"v2026.3.2-beta.1",
"v2026.3.2",
"v2026.3.1",
"v2026.2.26",
"v2026.2.26-beta.1",
"v2026.2.25",
"v2026.2.25-beta.1",
"v2026.2.24",
"v2026.2.24-beta.1",
"v2026.2.23",
"v2026.2.23-beta.1",
"v2026.2.22",
"v2026.2.22-beta.1",
"v2026.2.21",
"v2026.2.21-beta.1",
"v2026.2.19-beta.1",
"v2026.2.19",
"v2026.2.17",
"v2026.2.15-beta.1",
"v2026.2.14",
"v2026.2.13",
"v2026.2.12",
"v2026.2.9",
"v2026.2.6-3",
"v2026.2.6-2",
"v2026.2.6-1",
"v2026.2.6",
"v2026.2.3",
"v2026.2.2",
"v2026.2.1",
"v2026.1.30",
"v2026.1.29",
"v2026.1.24-1",
"v2026.1.24",
"v2026.1.23",
"v2026.1.22",
"v2026.1.21",
"v2026.1.20",
"v2026.1.16-2",
"v2026.1.15",
"v2026.1.14-1",
"v2026.1.13",
"v2026.1.12-2",
"v2026.1.12",
"v2026.1.11-3",
"v2026.1.11-2",
"v2026.1.11-1",
"v2026.1.11",
"v2026.1.10",
"v2026.1.9",
"v2026.1.8",
"v2026.1.5-3",
"v2026.1.5-2",
"v2026.1.5-1",
"v2026.1.5",
"v2.0.0-beta5",
"v2.0.0-beta4",
"v2.0.0-beta3",
"v2.0.0-beta2",
"v2.0.0-beta1",
"v1.3.0",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.0",
"v1.0.4",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53847.json"
}
}
],
"modified": "2026-10-28T02:30:38.907176843Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53847.json",
"https://github.com/openclaw/openclaw/security/advisories/GHSA-x629-46cc-7xgw",
"https://nvd.nist.gov/vuln/detail/CVE-2026-53847",
"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-active-memory-write-scope",
"https://github.com/openclaw/openclaw"
],
"provider_metadata": {
"cwe_ids": [
"CWE-266"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53847.json"
}
},
"related_cves": [
{
"value": "CVE-2026-53847",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 506389,
"published_at": "2026-06-16T18:04:58.195+00:00"
}