VYPR
← All advisories
High severity8.1NVD Advisory· Published Jun 16, 2026· Updated Jun 16, 2026

CVE-2026-53849

CVE-2026-53849

Description

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.5.72026.5.7

Affected products

2
  • OpenClaw/Openclawinferred2 versions
    <2026.5.7+ 1 more
    • (no CPE)range: <2026.5.7
    • (no CPE)range: <2026.5.7

Patches

Vulnerability mechanics

References

4

News mentions

1