CVE-2026-53844

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path to retrieve memory entries that should not be visible to their session.

CVSS 4.0

6.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-25)

CWE

CWE-862

Published

2026-06-16

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

Affected

• openclaw:openclaw

Packages (OSV)

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-72fw-cqh5-f324
• https://www.vulncheck.com/advisories/openclaw-session-visibility-check-bypass-in-shared-memory-search

Check your stackJSON