CVE-2026-53854

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.25

Description An issue in internal and webchat command authentication allows senders to inherit wildcard ownerAllowFrom state across channel boundaries. This enables attackers to send commands on affected internal or webchat paths to execute owner-style command behavior outside the intended channel scope, potentially bypassing access controls.

Recommendations Update to version 2026.4.25. Keep owner command allowlists explicit per channel. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.