VULNERABILITY INTELLIGENCE

CVE-2026-53849

CVSS score8.1 HIGH
EPSS probability0.27%
CISA KEVNot currently listed
Published2026-06-16
Last modified2026-06-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

Weakness classification

  • disclosure@vulncheck.com: CWE-290

Primary references