CVE-2026-53823
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
OpenClaw before version 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other identities.
Risk Assessment
Organizations may be exposed to unauthorized access to resources, potentially leading to serious security breaches and data loss. Privilege escalation by attackers could result in unauthorized actions within the system.
Recommendation
It is recommended to update OpenClaw to version 2026.5.3 or later to mitigate this vulnerability. Additionally, conducting an audit of user permissions in Slack is advisable to minimize the risk of unauthorized access.
Original NVD description (English source)
OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other identities.