CVE-2026-53823Disclosure(openclaw / openclaw)

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other identities.

openclaw CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-290

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-06-13); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-13	3	Disclosure3
2026-06-23	1	Disclosure1

Full discourse4 posts

Joey Romaine 🇺🇸 |=★=|@Tank23x0126d
Disclosure
CVSS 8.1. CVE-2026-53823. Worth reading before your users find out the hard way. OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mu... New week. Sharper than the last.
Post summary
CVE-2026-53823 is a high‑scoring privilege escalation flaw in OpenClaw's allowFrom feature, disclosed with CVSS 8.1 and technical details but without available exploit or patch information.
0000047
339 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-53823 OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack accoun… https://www.cve.org/CVERecord?id=CVE-2026-53823 ----- Traducción: CVE-2026-53823 Ope… http://infoflow.cloud`
Post summary
New CVE-2026-53823 reveals a privilege escalation flaw in OpenClaw (versions before 2026.5.3) that exploits mutable Slack display names through the allowFrom feature.
0000041
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-53823 OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack accoun… https://www.cve.org/CVERecord?id=CVE-2026-53823
Post summary
A new CVE (CVE-2026-53823) is disclosed, outlining a privilege escalation flaw in OpenClaw's allowFrom feature that leverages mutable Slack display names; no exploitation activity or patch information is provided.
00000334
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-53823 Privilege Escalation in OpenClaw Before 2026.5.3 via Mutable Slack Display Names https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-53823
Post summary
The text announces the identification of a privilege escalation vulnerability (CVE‑2026‑53823) in OpenClaw versions prior to 2026.5.3, noting the exploitation vector via mutable Slack display names, but does not provide a PoC, exploit code, active exploitation evidence, or remediation guidance.
0000059
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-53823

Joey Romaine 🇺🇸 |=★=|[verified]@Tank23x0Disclosure

CVE-2026-53823 is a high‑scoring privilege escalation flaw in OpenClaw's allowFrom feature, disclosed with CVSS 8.1 and technical details but without available exploit or patch information.

Infoflowcloud@infoflowcloudDisclosure

New CVE-2026-53823 reveals a privilege escalation flaw in OpenClaw (versions before 2026.5.3) that exploits mutable Slack display names through the allowFrom feature.

CVE@CVEnewDisclosure

A new CVE (CVE-2026-53823) is disclosed, outlining a privilege escalation flaw in OpenClaw's allowFrom feature that leverages mutable Slack display names; no exploitation activity or patch information is provided.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces the identification of a privilege escalation vulnerability (CVE‑2026‑53823) in OpenClaw versions prior to 2026.5.3, noting the exploitation vector via mutable Slack display names, but does not provide a PoC, exploit code, active exploitation evidence, or remediation guidance.