CVE-2026-53853: OpenClaw Exec Allowlist Bypass on Linux and macOS
Summary
CVE-2026-53853: OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns. Affects openclaw versions < 2026.5.12. Fixed in 2026.5.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an open-source tool designed to facilitate secure execution of commands and scripts in various environments. It employs an exec allowlist feature that restricts which executables can be run, enhancing security by preventing unauthorized command execution. However, a vulnerability has been identified that affects the exec allowlist functionality on Linux and macOS systems, allowing certain argument patterns to be bypassed.
Vulnerability Detail
The vulnerability arises from OpenClaw's exec allowlist implementation, which is supposed to enforce restrictions on command arguments through configured 'argPattern' entries. In affected versions, the checks for 'argPattern' are skipped on Linux and macOS, allowing executables to be run with disallowed arguments without prompting for approval. This can lead to unauthorized access to system resources, file manipulation, or execution of malicious commands, especially if an untrusted sender can influence the execution context.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5.12
This is the first release that contains the fix.
npm install openclaw@2026.5.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, operators can avoid using 'argPattern' in exec allowlist entries for executables that accept security-relevant arguments until the upgrade is completed.
Conclusion
In summary, CVE-2026-53853 is a significant vulnerability in OpenClaw that compromises the exec allowlist functionality on Linux and macOS. It is crucial for users to upgrade to the patched version to mitigate the risks associated with unauthorized command execution.
See every vulnerability recorded for openclaw →
FAQ
CVE-2026-53853 is a vulnerability in OpenClaw that allows bypassing configured argument patterns for exec allowlists on Linux and macOS, potentially leading to unauthorized command execution.
The vulnerability affects OpenClaw deployments running on Linux and macOS systems where exec is configured with allowlist security.
The risks include unauthorized execution of commands, potential data breaches, and system compromise if untrusted users can influence command execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
