PT-2026-49031 · Openclaw · Openclaw

Anshuman Bhartiya

·

CVE-2026-53827

·

Published

2026-06-12

·

Updated

2026-07-02

CVSS v4.0

6.8

Medium

VectorAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.2
Description An issue in message.action forwarding allows model-controlled metadata to forward action payloads containing Gateway credentials to attacker-supplied loopback URLs. Remote attackers can intercept Gateway tokens and action payloads by providing malicious loopback targets through model-controlled action metadata.
Recommendations Update to version 2026.5.2.

Exploit

Fix

Insufficiently Protected Credentials

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-522CWE-918

Related Identifiers

CVE-2026-53827
GHSA-GRC3-2J34-P6GM

Affected Products

Openclaw