CVE-2026-53836: Openclaw Auth Bypass Vulnerability

CVE-2026-53836 Overview

CVE-2026-53836 is an allowlist bypass vulnerability affecting OpenClaw versions prior to 2026.5.12. The flaw resides in PowerShell encoded-command handling, where the allowlist parser fails to recognize abbreviated flag aliases. Remote authenticated operators can submit unrecognized encoded-command alias forms to bypass execution allowlist checks and run arbitrary PowerShell content. The weakness is classified under [CWE-184] (Incomplete List of Disallowed Inputs). With network attack vector and low privilege requirements, the vulnerability enables high impact to confidentiality, integrity, and availability of the host system.

Critical Impact
Authenticated operators can execute arbitrary PowerShell on systems running OpenClaw, bypassing the command allowlist entirely and gaining full code execution on protected hosts.

Affected Products

OpenClaw (all versions before 2026.5.12)
OpenClaw deployments on Node.js runtimes
OpenClaw multi-operator environments exposing PowerShell execution endpoints

Discovery Timeline

2026-06-12 - CVE-2026-53836 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53836

Vulnerability Analysis

OpenClaw enforces an allowlist on PowerShell command invocations to restrict which encoded-command operations operators can execute. The allowlist parser inspects incoming command strings for the canonical -EncodedCommand flag. PowerShell, however, accepts multiple abbreviated alias forms of this parameter, including shorter variants such as -Enc, -EncodedC, and other prefix matches. The allowlist parser does not normalize these alias forms before evaluation. Attackers craft requests using an unrecognized alias variant, which slips past the allowlist check while still being honored by the underlying PowerShell host. The result is full PowerShell execution outside the intended security boundary.

Root Cause

The root cause is an incomplete deny/allow list ([CWE-184]) that does not account for the parameter-name resolution behavior of PowerShell. PowerShell resolves any unambiguous prefix of a parameter name to the full parameter, but the OpenClaw parser only matches the full literal token. This mismatch between parser semantics and PowerShell semantics enables the bypass.

Attack Vector

Exploitation requires an authenticated operator account with permission to submit PowerShell commands to OpenClaw. The attacker substitutes the canonical encoded-command flag with an abbreviated alias and supplies a Base64-encoded PowerShell payload. OpenClaw's allowlist does not match the alias and forwards the command to PowerShell, which decodes and executes the payload. No user interaction is required, and the attack is delivered over the network.

No public proof-of-concept code has been released. Refer to the VulnCheck Advisory and the GitHub Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-53836

Indicators of Compromise

PowerShell process invocations spawned by the OpenClaw service containing abbreviated encoded-command flags such as -Enc, -EncodedC, or -e followed by Base64 data.
OpenClaw audit log entries showing operator-submitted commands that were forwarded to PowerShell without a matching allowlist entry.
Outbound network connections or file writes originating from PowerShell child processes of the OpenClaw runtime that are not part of approved workflows.

Detection Strategies

Hunt for PowerShell command lines that contain any prefix of -EncodedCommand shorter than the full token, paired with Base64-encoded content.
Correlate authenticated OpenClaw operator sessions with subsequent powershell.exe or pwsh process creation events using parent-child process telemetry.
Decode Base64 arguments captured in process command lines and inspect them for cmdlets associated with credential access, persistence, or lateral movement.

Monitoring Recommendations

Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging on all hosts running OpenClaw to capture decoded payload content.
Forward Windows Security Event ID 4688 process creation events with full command-line auditing to a centralized analytics platform.
Alert on any OpenClaw-spawned PowerShell process whose command line does not exactly match the approved allowlist canonical form.

How to Mitigate CVE-2026-53836

Immediate Actions Required

Upgrade OpenClaw to version 2026.5.12 or later on all hosts where the product is deployed.
Audit existing operator accounts and revoke PowerShell submission privileges from any account that does not require them.
Review historical OpenClaw and PowerShell logs for evidence of abbreviated encoded-command flag usage prior to patching.

Patch Information

The vendor has released a fixed build in OpenClaw 2026.5.12. The patch normalizes PowerShell parameter aliases before allowlist evaluation so that abbreviated forms of -EncodedCommand are resolved to the canonical token and matched correctly. Patch details are published in the GitHub Security Advisory GHSA-j472-gf56-x589.

Workarounds

Restrict OpenClaw network exposure so the operator interface is reachable only from trusted management networks while patching is in progress.
Configure host-based PowerShell Constrained Language Mode or AppLocker rules to block PowerShell execution by the OpenClaw service account.
Add a wrapping proxy or input filter that rejects any operator-submitted command containing a -E-prefixed parameter other than the explicit full -EncodedCommand token.

bash

# Configuration example: upgrade OpenClaw and verify version
npm install -g openclaw@2026.5.12
openclaw --version
# Expected output: 2026.5.12 or later