{"id":"EUVD-2026-36627","enisaUuid":"ea505307-7149-3fa7-963d-8d02303bba20","description":"OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.","datePublished":"Jun 12, 2026, 9:57:01 PM","dateUpdated":"Oct 8, 2026, 3:23:12 PM","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-77q5-rr5v-x43q\nhttps://www.vulncheck.com/advisories/openclaw-hostname-prefix-matching-bypass-in-trusted-retry-endpoint-validation\n","aliases":"CVE-2026-53839\nGHSA-wcpv-6hg7-mfcc\n","assigner":"VulnCheck","epss":0.26,"enisaIdProduct":[{"id":"574860e1-74d9-339d-8e85-6b6c8eb90dd8","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.5.7"}],"enisaIdVendor":[{"id":"3c5a2084-a0a5-36d0-9113-42ee3f402286","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"2979b0a6-c604-3ca9-a473-14bd9b78a223","vulnerability":{"id":"GHSA-wcpv-6hg7-mfcc","description":"OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.","datePublished":"Jun 13, 2026, 12:34:33 AM","dateUpdated":"Jun 13, 2026, 12:34:33 AM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-77q5-rr5v-x43q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53839\nhttps://www.vulncheck.com/advisories/openclaw-hostname-prefix-matching-bypass-in-trusted-retry-endpoint-validation\n","enisa_id":"EUVD-2026-36627\n","aliases":"CVE-2026-53839\nGHSA-wcpv-6hg7-mfcc\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6ae79146-b26f-39ec-910e-789f48305995","vulnerability":{"id":"CVE-2026-53839","description":"OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.","datePublished":"Jun 12, 2026, 9:57:01 PM","dateUpdated":"Oct 8, 2026, 3:23:12 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-77q5-rr5v-x43q\nhttps://www.vulncheck.com/advisories/openclaw-hostname-prefix-matching-bypass-in-trusted-retry-endpoint-validation\n","enisa_id":"EUVD-2026-36627\n","assigner":"VulnCheck","epss":0.26,"dataProcessed":"Nov 7, 2026, 7:20:34 AM","vulnerabilityProduct":[{"id":"dded18f4-a730-3995-bac4-a1d6a21735c1","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.5.7"}],"vulnerabilityVendor":[{"id":"4cf9575d-ff26-34d7-a0ef-c957e7e67ba2","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[]}