CVE-2026-53808

OpenClaw < 2026.5.6 - Approval Policy Bypass in Skill Workshop Apply Flow

State: Published
Severity: 6.0 Medium
Published: Jun 11, 2026
Updated: Jun 23, 2026
Reserved: Jun 10, 2026

Description

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true despite approvalPolicy: pending configuration. Attackers can exploit this by reaching the affected apply path to apply workshop changes before the expected approval step, potentially modifying configurations without proper authorization.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	VulnCheck

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.5.6Affected 2026.5.6Not affected

References

GitHub Security Advisory (GHSA-cqwv-9qjx-vxw2)vendor-advisory
https://www.vulncheck.com/advisories/openclaw-approval-policy-bypass-in-skill-workshop-apply-flowthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.