CVE-2026-53866: Openclaw Auth Bypass Vulnerability

CVE-2026-53866 Overview

CVE-2026-53866 affects OpenClaw versions prior to 2026.5.12. The vulnerability is an allowlist bypass in the shell inline-command parser that allows authenticated operators to execute unapproved commands. A command request constructed using shell inline-command forms routes through a parser case that lacks the expected allowlist decision. As a result, shell content executes without triggering the intended approval prompt.

The weakness is classified as [CWE-862] Missing Authorization. It impacts the openclaw:openclaw Node.js package, including all 2026.5.12 beta releases (beta1 through beta8).

Critical Impact
Authenticated operators can bypass the OpenClaw command allowlist and execute arbitrary shell content, breaking the approval-prompt security boundary that gates privileged actions.

Affected Products

OpenClaw (Node.js distribution) — all versions before 2026.5.12
OpenClaw 2026.5.12beta1 through beta8
Component identifier: openclaw:openclaw

Discovery Timeline

2026-06-16 - CVE-2026-53866 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-53866

Vulnerability Analysis

OpenClaw enforces a command allowlist that gates which shell content authenticated operators are permitted to run. Operators normally see an approval prompt before sensitive commands execute. The vulnerability defeats this gate when commands are submitted through the shell inline-command form.

The inline-command parser contains a code path that handles a specific request shape without invoking the allowlist decision logic. Requests that traverse this path skip both the allowlist check and the approval prompt. The shell content then executes with the operator's privileges as if it had been approved.

Because the flaw resides in the parsing layer rather than the policy layer, allowlist rules configured by administrators provide no protection for requests routed through the affected case. The vulnerability requires valid operator credentials but no user interaction beyond submitting the crafted request.

Root Cause

The root cause is a missing authorization check ([CWE-862]) in one branch of the inline-command parser. The expected allowlist decision is present in sibling parsing branches but absent in the affected case. The asymmetry allows specifically shaped command requests to reach execution without policy evaluation.

Attack Vector

The attack is network-reachable and requires low-privilege authentication as an OpenClaw operator. An attacker with valid operator credentials, or who compromises an operator account, submits a command using the shell inline-command form. The request bypasses the allowlist and executes shell content of the attacker's choice on the host running OpenClaw.

No verified proof-of-concept exploit is publicly available. The CISA Known Exploited Vulnerabilities catalog does not list this CVE, and the EPSS score is 0.26%. Technical specifics are documented in the VulnCheck Advisory on OpenClaw and the GitHub Security Advisory GHSA-f397-5vjw-v2c2.

Detection Methods for CVE-2026-53866

Indicators of Compromise

Execution of shell commands by OpenClaw worker processes without a corresponding approval prompt event in the audit log.
Operator command submissions using inline-command request forms targeting binaries or scripts outside the configured allowlist.
Child processes spawned by the OpenClaw runtime that do not match previously observed approved-command baselines.

Detection Strategies

Correlate OpenClaw command-execution audit entries with approval-prompt events; alert on executions that lack a matching approval record.
Inventory OpenClaw deployments and flag any instance running a version below 2026.5.12 (final release), including beta1 through beta8.
Monitor process telemetry on hosts running OpenClaw for unexpected child processes of the OpenClaw Node.js runtime.

Monitoring Recommendations

Enable verbose OpenClaw audit logging for the inline-command parser path and forward logs to a centralized analytics platform.
Track per-operator command-execution rates and alert on volume spikes or commands deviating from established allowlists.
Review operator account activity for unusual sources, off-hours sessions, or credential reuse that could indicate account takeover.

How to Mitigate CVE-2026-53866

Immediate Actions Required

Upgrade OpenClaw to version 2026.5.12 or later on all hosts.
Treat all 2026.5.12 beta builds (beta1 through beta8) as vulnerable and replace them with the final release.
Rotate operator credentials and audit recent inline-command activity for unapproved executions.
Restrict network access to the OpenClaw management interface so that only trusted operator workstations can reach it.

Patch Information

The vendor fixed CVE-2026-53866 in OpenClaw 2026.5.12. The fix routes inline-command parsing through the same allowlist decision used by other command forms, restoring the approval-prompt boundary. Patch details and the fix commit are referenced in the GitHub Security Advisory GHSA-f397-5vjw-v2c2.

Workarounds

Disable or block use of the shell inline-command form for operator accounts until upgrading is possible.
Apply least-privilege principles to the operating-system account running the OpenClaw process to limit the impact of any executed shell content.
Place OpenClaw behind an authenticating reverse proxy and require multi-factor authentication for operator sessions to reduce the risk of credential abuse.

bash

# Upgrade OpenClaw via npm to the patched release
npm install -g openclaw@2026.5.12

# Verify the installed version is at or above the fixed release
openclaw --version