{"cve":"CVE-2026-53824","nvd":{"published":"2026-06-12T22:16:53.613","modified":"2026-07-23T09:10:00.113","status":"Analyzed","description":"OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":6.0},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-613"],"references":["https://github.com/openclaw/openclaw/security/advisories/GHSA-4m3v-q747-pc6h","https://www.vulncheck.com/advisories/mattermost-slash-token-revocation-lag-via-monitor-refresh-delay"],"products":["openclaw:openclaw"],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-53824","score":0.00181,"percentile":0.07694,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4m3v-q747-pc6h","url":"https://osv.dev/vulnerability/GHSA-4m3v-q747-pc6h","summary":"OpenClaw: Mattermost slash token revocation could lag until monitor refresh","modified":"2026-07-08T08:11:47.625624169Z","packages":[{"ecosystem":"npm","name":"openclaw","purl":"pkg:npm/openclaw","ranges":["<2026.4.24"],"fixed":["2026.4.24"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}