← Database

CVE-2026-53820

MEDIUM CVSS: 6.6 Published: 2026-06-12 Modified: 2026-07-23

Description

OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled MCP session-spawn path to start sessions with broader command reach than intended.

Affected Platforms

Openclaw Openclaw

Weakness Type

CWE-862

References