CVE-2026-53809

OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

State: Published
Severity: 4.8 Medium
Published: Jun 11, 2026
Updated: Jun 23, 2026
Reserved: Jun 10, 2026

Description

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N	VulnCheck
3.1	3.8 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.4.25Affected 2026.4.25Not affected

References

GitHub Security Advisory (GHSA-p39j-x9h5-q66m)vendor-advisory
https://www.vulncheck.com/advisories/openclaw-provider-alias-confusion-in-embedded-runner-policythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.