CVE-2026-53839mediumCWE-1023

CVE-2026-53839: medium-severity vulnerability in OpenClaw

OpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6epss 0.5%
exploitation probability
0.5%top 62% of all CVEs
observed exploitation
nono source reports it
In short

OpenClaw before version 2026.5.7 has a flaw where it accepts hostnames that start with a trusted name instead of matching exactly, allowing attackers to trick the system into sending login credentials to fake servers.

Technical detail

The vulnerability stems from incomplete hostname validation in retry endpoint checks (CWE-1023), where prefix matching is used instead of exact string comparison. An attacker can craft a malicious hostname with a trusted prefix to intercept authentication material sent during retry operations, requiring network positioning to exploit.

Summary generated and translated by AI from the official description.
OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
OpenClaw · OpenClaw
Related CVEs — OpenClaw

In the same product, most dangerous first.

CVE-2026-25253HIGHCVE-2026-25253EPSS 24.4%CVE-2026-32917CRITICALOpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCPEPSS 3.2%CVE-2026-53822HIGHOpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and ExecutionEPSS 2.0%CVE-2026-32052MEDIUMOpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv CarriersEPSS 1.6%CVE-2026-44998LOWOpenClaw < 2026.4.20 - Tool Policy Bypass via Bundled MCP/LSP ToolsEPSS 1.2%CVE-2026-44109CRITICALOpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action ValidationEPSS 1.1%
References
https://github.com/openclaw/openclaw/security/advisories/GHSA-77q5-rr5v-x43qhttps://www.vulncheck.com/advisories/openclaw-hostname-prefix-matching-bypass-in-trusted-retry-endpoint-validation