CVE-2026-53857

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.

CVSS 4.0

8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-25)

CWE

CWE-290

Published

2026-06-16

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• openclaw:openclaw

Packages (OSV)

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8c59-hr4w-qg69
• https://www.vulncheck.com/advisories/openclaw-mutable-display-name-binding-in-zalo-allowfrom-policy

Check your stackJSON