{"id":"CVE-2026-53850","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-06-16T19:17:02.183","lastModified":"2026-10-24T13:10:00.147","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority, potentially enabling unauthorized operations depending on gateway configuration and input trust levels."},{"lang":"es","value":"OpenClaw anterior a 2026.4.25 contiene una vulnerabilidad de omisión de la aplicación del alcance de control en el comando focus que permite a los llamadores autenticados ejecutar el comando sin las comprobaciones de autorización adecuadas. Los atacantes pueden activar el comando focus para cambiar el estado de enfoque fuera de la autoridad prevista del llamador, lo que podría permitir operaciones no autorizadas dependiendo de la configuración de la pasarela y los niveles de confianza de entrada."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw","defaultStatus":"unaffected","repo":"https://github.com/openclaw/openclaw","packageURL":"pkg:npm/openclaw","versions":[{"version":"0","lessThan":"2026.4.25","versionType":"semver","status":"affected"},{"version":"2026.4.25","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-16T18:38:22.508672Z","id":"CVE-2026-53850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2026.4.25","matchCriteriaId":"A1C7E0A9-FE18-4FC0-B084-962ED0BC7EC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta1:*:*:*:node.js:*:*","matchCriteriaId":"47423C4C-E76E-4143-8AB9-C7828BFAB409"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta10:*:*:*:node.js:*:*","matchCriteriaId":"991BD889-5FA3-4665-BA49-B8DAF1F0BE19"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta11:*:*:*:node.js:*:*","matchCriteriaId":"C2DEC581-0C75-4797-AE9B-16AE8B61CFA5"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta2:*:*:*:node.js:*:*","matchCriteriaId":"B66A863E-509A-4B70-81D7-7CBAAE35562A"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta3:*:*:*:node.js:*:*","matchCriteriaId":"22C31BB6-8D7E-440E-9307-85E1B5D6EFE3"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta4:*:*:*:node.js:*:*","matchCriteriaId":"FA94F68E-C254-4693-8178-2350AFF03340"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta5:*:*:*:node.js:*:*","matchCriteriaId":"81E3D764-EC83-44F8-BBBF-ACB6009B210F"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta6:*:*:*:node.js:*:*","matchCriteriaId":"87569369-BAA7-4E88-9370-F8C6C8548EDA"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta7:*:*:*:node.js:*:*","matchCriteriaId":"61334610-1CDA-4AC4-A62B-4CA0E1448891"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta8:*:*:*:node.js:*:*","matchCriteriaId":"692249CF-9643-4B03-B180-B6F7588547DE"},{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:2026.4.25:beta9:*:*:*:node.js:*:*","matchCriteriaId":"750B5EC7-F749-4656-AEE5-D1F403F56B6B"}]}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mpc8-jxjh-qpgh","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/openclaw-control-scope-enforcement-bypass-in-focus-command","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}