PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53847 OpenClaw CVE debrief

CVE-2026-53847 is a medium-severity privilege escalation vulnerability in OpenClaw before 2026.5.6. The vulnerability allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. This is possible due to insufficient scope validation in the Active Memory write scope, enabling attackers to apply unauthorized configuration changes beyond the intended write scope.

Vendor
OpenClaw
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-16
Original CVE updated
2026-06-17
Advisory published
2026-06-16
Advisory updated
2026-06-17

Who should care

Users of OpenClaw before version 2026.5.6, particularly those with Gateway operator roles, should be aware of this vulnerability. It may allow attackers with operator.write access to escalate their privileges and modify global configurations.

Technical summary

The vulnerability has a CVSS score of 5.3 and is classified as CWE-266. It can be exploited by attackers with existing operator.write access, allowing them to make unauthorized changes to the global configuration.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade OpenClaw to version 2026.5.6 or later.
  • Review and restrict operator.write access to minimize the attack surface.
  • Monitor for any unauthorized configuration changes.

Evidence notes

The CVE record and details were obtained from the official CVE.org and NVD sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53847 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53847

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53847 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53847

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.