VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jun 16, 2026· Updated Jun 17, 2026

CVE-2026-53845

CVE-2026-53845

Description

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable dispatch path to bypass hook-based auditing and policy enforcement mechanisms.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.5.62026.5.6

Affected products

4
  • OpenClaw/Openclawllm-fuzzy4 versions
    <2026.5.6+ 3 more
    • (no CPE)range: <2026.5.6
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.5.6
    • cpe:2.3:a:openclaw:openclaw:2026.5.6:beta1:*:*:*:node.js:*:*
    • (no CPE)range: <2026.5.6

Patches

Vulnerability mechanics

References

4

News mentions

1