What’s Vulnerable › Vulnerabilities

CVE-2026-53827: OpenClaw < 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwarding

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-12 · updated 2026-07-23
• Weakness: CWE-918

Description

OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payloads with Gateway credentials to attacker-supplied loopback URLs. Remote attackers can intercept Gateway tokens and action payloads by providing malicious loopback targets through model-controlled action metadata.

Affected products

• OpenClaw: before 2026.5.2 — fixed in 2026.5.2

How to fix

Upgrade to a fixed version: OpenClaw 2026.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-grc3-2j34-p6gm
• https://www.vulncheck.com/advisories/openclaw-credential-exposure-via-model-supplied-loopback-urls-in-message-action-forwarding

Get alerted when CVE-2026-53827 or the next vulnerability affects your stack