CVE-2026-53845

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6

Description A hook bypass issue exists where skill commands routed through a specific dispatch path skip the runBeforeToolCallHook coverage. This allows attackers to send skill commands through the affected path to bypass hook-based auditing and policy enforcement mechanisms. The impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable path.

Recommendations Update to version 2026.5.6. Avoid relying on hook-only enforcement for skill commands. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.