CVE-2026-53844

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path to retrieve memory entries that should not be visible to their session.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openclaw/openclaw/security/advisories/GHSA-72fw-cqh5-f324	Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-session-visibility-check-bypass-in-shared-memory-search	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openclaw:openclaw::::::node.js::*
	cpe:2.3:a:openclaw:openclaw:2026.4.29:beta1::::node.js::*
	cpe:2.3:a:openclaw:openclaw:2026.4.29:beta2::::node.js::*
	cpe:2.3:a:openclaw:openclaw:2026.4.29:beta3::::node.js::*
	cpe:2.3:a:openclaw:openclaw:2026.4.29:beta4::::node.js::*

History

No history.

Information

Published : 2026-06-16 19:17

Updated : 2026-06-17 20:30

NVD link : CVE-2026-53844

Mitre link : CVE-2026-53844

CVE.ORG link : CVE-2026-53844

JSON object : View

Products Affected

openclaw

openclaw

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-53844", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53844", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T18:38:49.770928Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/openclaw/openclaw", "vendor": "OpenClaw", "product": "OpenClaw", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.4.29", "versionType": "semver"}, {"status": "unaffected", "version": "2026.4.29", "versionType": "semver"}], "packageURL": "pkg:npm/openclaw", "defaultStatus": "unaffected"}]}], "published": "2026-06-16T19:17:01.390", "references": [{"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-72fw-cqh5-f324", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/openclaw-session-visibility-check-bypass-in-shared-memory-search", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path to retrieve memory entries that should not be visible to their session."}], "lastModified": "2026-06-17T20:30:39.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FD093CBC-6B1F-481A-B12D-0E06B0F4FF8C", "versionEndExcluding": "2026.4.29"}, {"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "06F1B1BC-A38C-40D2-A66F-BFF44FCA096E"}, {"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta2:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "5253E817-4E8F-4936-B94E-432908CEF8CE"}, {"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta3:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "1969F355-06D5-4313-86C7-DD91EE58F7BF"}, {"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta4:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "A5AC7CB7-6639-4F11-8A81-3A35D334C762"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}