CVE-2026-53847

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6

Description Insufficient scope validation in the Active Memory write scope allows Gateway operators with operator.write access to modify global configuration. This privilege escalation enables users to apply unauthorized configuration changes without requiring operator.admin privileges.

Recommendations Update to version 2026.5.6. Limit Active Memory write access to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the Active Memory write feature when it is not needed.