CVE-2026-53820

Published June 12th, 2026

View on NVD ↗

CVSS v3

6.6

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled MCP session-spawn path to start sessions with broader command reach than intended.

openclaw/openclaw

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

GitHub

380K