Dashboard / CVE-2026-53850

CVE-2026-53850

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 39/100
Published: 2026-06-16 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: None
VI: High
VA: None

Description

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority, potentially enabling unauthorized operations depending on gateway configuration and input trust levels.

Weakness Classification (1)

Affected Software (12)

VendorProductVersion
openclaw openclaw < 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25
openclaw openclaw 2026.4.25

References & Advisories (2)

Bug Bounty Relevance

39 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

6.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.09%
Raw Score 0.000930
Percentile 0.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00093
2026-10-28
0.00093

Intelligence Sources

nvd ref →

External Links