CVE-2026-53850

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.25

Description A control scope enforcement bypass exists in the focus command. This allows authenticated callers to execute the command without proper authorization checks, enabling them to change the focus state outside of the intended caller authority. The practical impact depends on the gateway configuration and whether lower-trust input can reach the affected path.

Recommendations Update to version 2026.4.25. Restrict focus command access to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the focus command feature when it is not needed.