CVE-2026-53844: Openclaw Auth Bypass Vulnerability

CVE-2026-53844 Overview

CVE-2026-53844 is a missing authorization vulnerability [CWE-862] in OpenClaw versions prior to 2026.4.29. The flaw resides in the shared memory search path, where session visibility guards are not consistently enforced. Authenticated callers can skip these checks and retrieve memory entries belonging to other sessions.

The vulnerability affects the Node.js distribution of OpenClaw, including beta releases 2026.4.29-beta1 through 2026.4.29-beta4. Exploitation requires only low-privileged authenticated access and a network-reachable instance.

Critical Impact
Authenticated attackers can read shared memory entries scoped to other sessions, exposing confidential data without triggering authorization errors.

Affected Products

OpenClaw versions prior to 2026.4.29 (Node.js distribution)
OpenClaw 2026.4.29-beta1, beta2, beta3, and beta4
All deployments exposing the shared memory search interface to authenticated users

Discovery Timeline

2026-06-16 - CVE-2026-53844 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53844

Vulnerability Analysis

The vulnerability stems from inconsistent authorization enforcement in OpenClaw's shared memory subsystem. OpenClaw maintains shared memory entries that are logically partitioned by session. Read paths such as direct fetch operations enforce a session visibility check before returning data.

The search path, however, omits this guard. When an authenticated caller invokes the search interface, matching entries are returned regardless of whether the requesting session owns them. This breaks the session isolation contract that callers and downstream consumers depend on.

The issue is classified as Missing Authorization [CWE-862]. It does not require chained vulnerabilities — a single authenticated request to the search endpoint is sufficient to retrieve entries that should be invisible to the caller.

Root Cause

The root cause is a missing authorization check on the shared memory search code path. While point-lookup and fetch operations validate that the requested entry is visible to the active session, the search routine iterates over the shared memory store and returns matches without applying the same visibility filter. The session context exists at the call site but is not consulted during result construction.

Attack Vector

An attacker requires valid low-privileged credentials and network access to the OpenClaw service. The attacker authenticates, then issues search queries against shared memory. Returned results include entries owned by other sessions, enabling cross-tenant data disclosure. No user interaction from victims is required. The attack does not modify data or affect availability — impact is limited to confidentiality.

The vulnerability is described in the VulnCheck Security Advisory and the GitHub Security Advisory GHSA-72fw-cqh5-f324.

Detection Methods for CVE-2026-53844

Indicators of Compromise

Authenticated sessions issuing high volumes of shared memory search queries with broad or wildcard match patterns
Search responses returning entry identifiers that do not correlate to the requesting session's prior write or fetch activity
Application logs showing successful search results immediately followed by direct fetch attempts against unfamiliar entry keys

Detection Strategies

Audit OpenClaw application logs for search invocations and cross-reference returned entry ownership against the authenticated session identifier
Deploy runtime instrumentation around the shared memory search handler to record session ID, query parameters, and returned entry owners
Flag any session that retrieves entries it did not create or was not explicitly granted access to

Monitoring Recommendations

Centralize OpenClaw access logs and alert on anomalous search-to-fetch ratios per session
Track authentication events alongside shared memory operations to baseline normal per-session behavior
Monitor for newly created low-privileged accounts followed by immediate search activity against the shared memory store

How to Mitigate CVE-2026-53844

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.29 or later, which restores session visibility checks on the search path
Inventory all OpenClaw deployments, including the Node.js distribution and any beta builds (beta1 through beta4), and prioritize internet-facing instances
Rotate any credentials or secrets that may have been stored in shared memory entries during the exposure window

Patch Information

The fix is delivered in OpenClaw 2026.4.29. Refer to the GitHub Security Advisory GHSA-72fw-cqh5-f324 for patch details and the upstream commit references. The patched release adds the session visibility check to the shared memory search path so that results are filtered to entries the requesting session is authorized to view.

Workarounds

Restrict network access to OpenClaw endpoints to trusted clients only until the upgrade is applied
Reduce the privileges granted to authenticated callers and disable the search interface for accounts that do not require it
Segment OpenClaw instances per tenant or trust boundary so that a single shared memory store does not span multiple security domains

bash

# Verify the installed OpenClaw version and upgrade via npm
npm ls openclaw
npm install openclaw@2026.4.29