{"cve":"CVE-2026-53823","nvd":{"published":"2026-06-12T22:16:53.463","modified":"2026-07-23T09:10:00.113","status":"Analyzed","description":"OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other identities.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.6},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-290"],"references":["https://github.com/openclaw/openclaw/security/advisories/GHSA-c29c-2q9c-pc86","https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-mutable-slack-display-names-in-allowfrom"],"products":["openclaw:openclaw"],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-53823","score":0.00209,"percentile":0.11006,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-c29c-2q9c-pc86","url":"https://osv.dev/vulnerability/GHSA-c29c-2q9c-pc86","summary":"OpenClaw: Slack allowFrom could bind to mutable display names","modified":"2026-07-08T08:12:15.619283855Z","packages":[{"ecosystem":"npm","name":"openclaw","purl":"pkg:npm/openclaw","ranges":["<2026.5.3"],"fixed":["2026.5.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}