Vulnerabilities

TI-2026-38857 CVE-2026-53861 · GHSA-c226-q6fx-6j6c

OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS

LOW 26

OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags.

CVSS 4.0MEDIUM 5.3 Local Low privileges User interaction EPSS 0.00249 Published 2026-06-16 Fixed in 2026.5.6 CWE-184

TI-2026-38843 CVE-2026-53847 · GHSA-x629-46cc-7xgw

OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope

LOW 23

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.a…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00176 Published 2026-06-16 Fixed in 2026.5.6 CWE-266

TI-2026-38841 CVE-2026-53845 · GHSA-68xw-r643-9p5w

OpenClaw < 2026.5.6 - Skill-Command Dispatch Hook Bypass via Before-Tool-Call Hook Skipping

LOW 11

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00185 Published 2026-06-16 Fixed in 2026.5.6 CWE-693

Vulnerabilities

Filters

OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS

OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope

OpenClaw < 2026.5.6 - Skill-Command Dispatch Hook Bypass via Before-Tool-Call Hook Skipping