CVE-2026-53850
Full vulnerability record from the local CVENow database.
Description
OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority, potentially enabling unauthorized operations depending on gateway configuration and input trust levels.
Severity
MEDIUM
CVSS score
6.8
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-16 19:17:02.183000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-53850",
"sourceIdentifier": "[email protected]",
"published": "2026-06-16T19:17:02.183",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority, potentially enabling unauthorized operations depending on gateway configuration and input trust levels."
},
{
"lang": "es",
"value": "OpenClaw anterior a 2026.4.25 contiene una vulnerabilidad de omisión de la aplicación del alcance de control en el comando focus que permite a los llamadores autenticados ejecutar el comando sin las comprobaciones de autorización adecuadas. Los atacantes pueden activar el comando focus para cambiar el estado de enfoque fuera de la autoridad prevista del llamador, lo que podría permitir operaciones no autorizadas dependiendo de la configuración de la pasarela y los niveles de confianza de entrada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "OpenClaw",
"product": "OpenClaw",
"defaultStatus": "unaffected",
"repo": "https://github.com/openclaw/openclaw",
"packageURL": "pkg:npm/openclaw",
"versions": [
{
"version": "0",
"lessThan": "2026.4.25",
"versionType": "semver",
"status": "affected"
},
{
"version": "2026.4.25",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-16T18:38:22.508672Z",
"id": "CVE-2026-53850",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "2026.4.25",
"matchCriteriaId": "A1C7E0A9-FE18-4FC0-B084-962ED0BC7EC6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta1:*:*:*:node.js:*:*",
"matchCriteriaId": "47423C4C-E76E-4143-8AB9-C7828BFAB409"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta10:*:*:*:node.js:*:*",
"matchCriteriaId": "991BD889-5FA3-4665-BA49-B8DAF1F0BE19"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta11:*:*:*:node.js:*:*",
"matchCriteriaId": "C2DEC581-0C75-4797-AE9B-16AE8B61CFA5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta2:*:*:*:node.js:*:*",
"matchCriteriaId": "B66A863E-509A-4B70-81D7-7CBAAE35562A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta3:*:*:*:node.js:*:*",
"matchCriteriaId": "22C31BB6-8D7E-440E-9307-85E1B5D6EFE3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta4:*:*:*:node.js:*:*",
"matchCriteriaId": "FA94F68E-C254-4693-8178-2350AFF03340"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta5:*:*:*:node.js:*:*",
"matchCriteriaId": "81E3D764-EC83-44F8-BBBF-ACB6009B210F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta6:*:*:*:node.js:*:*",
"matchCriteriaId": "87569369-BAA7-4E88-9370-F8C6C8548EDA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta7:*:*:*:node.js:*:*",
"matchCriteriaId": "61334610-1CDA-4AC4-A62B-4CA0E1448891"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta8:*:*:*:node.js:*:*",
"matchCriteriaId": "692249CF-9643-4B03-B180-B6F7588547DE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.25:beta9:*:*:*:node.js:*:*",
"matchCriteriaId": "750B5EC7-F749-4656-AEE5-D1F403F56B6B"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mpc8-jxjh-qpgh",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/openclaw-control-scope-enforcement-bypass-in-focus-command",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}