CVE-2026-53809— OpenClaw 安全漏洞
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting Interpreter新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-53809の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy
ソース: CVE Program / CVE List V5
脆弱性説明
OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
授权机制不正确
ソース: CVE Program / CVE List V5
脆弱性タイトル
OpenClaw 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.4.25之前版本存在安全漏洞，该漏洞源于嵌入式运行器策略中的策略绕过，允许使用提供商别名的请求与别名而非规范提供商身份进行比较。攻击者可在受影响功能启用时利用此混淆选择预期提供商策略限制之外的捆绑工具访问。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-53809の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-53809のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-53809 厂商安全公告 (2)
Same Patch Batch · OpenClaw · 2026-06-11 · 14 CVEs total
| CVE-2026-53806 | 8.8 HIGH | OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation |
| CVE-2026-53807 | 8.8 HIGH | OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands. |
| CVE-2026-53810 | 8.8 HIGH | OpenClaw < 2026.5.18 - Arbitrary Code Execution via Unscanned Marketplace Runtime Extensio |
| CVE-2026-53811 | 8.8 HIGH | OpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFrom |
| CVE-2026-53817 | 8.8 HIGH | OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing |
| CVE-2026-53819 | 8.8 HIGH | OpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env Override |
| CVE-2026-53814 | 8.3 HIGH | OpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool Authority |
| CVE-2026-53813 | 7.8 HIGH | OpenClaw < 2026.4.25 - Arbitrary Artifact Loading via Fake Package Root Resolution |
| CVE-2026-53812 | 7.7 HIGH | OpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act Interactions |
| CVE-2026-53816 | 7.2 HIGH | OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node |
| CVE-2026-53818 | 6.6 MEDIUM | OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback |
| CVE-2026-53808 | 6.5 MEDIUM | OpenClaw < 2026.5.6 - Approval Policy Bypass in Skill Workshop Apply Flow |
| CVE-2026-53815 | 6.5 MEDIUM | OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions |
IV. 関連脆弱性
同じ製品: OpenClaw
- CVE-2026-62228
OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Appro - CVE-2026-62229
OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching - CVE-2026-62227
OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot - CVE-2026-62226
OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Brow - CVE-2026-62225
OpenClaw < 2026.5.18 Authorization Bypass via Skill Command
同じベンダー: OpenClaw
- CVE-2026-62229
OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching - CVE-2026-62228
OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Appro - CVE-2026-62227
OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot - CVE-2026-62225
OpenClaw < 2026.5.18 Authorization Bypass via Skill Command - CVE-2026-62226
OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Brow
同じ弱点: CWE-863
V. CVE-2026-53809へのコメント
まだコメントはありません