CVE-2026-53827

MEDIUM

6.5

CVSS Severity Score

EPSS Score0.0650%

EPSS Percentile28.06th

Published2026年6月12日

Last Modified2026年6月12日

Vulnerability Description

OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payloads with Gateway credentials to attacker-supplied loopback URLs. Remote attackers can intercept Gateway tokens and action payloads by providing malicious loopback targets through model-controlled action metadata.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 https://github.com/openclaw/openclaw/security/advisories/GHSA-grc3-2j34-p6gm

🔗 https://www.vulncheck.com/advisories/openclaw-credential-exposure-via-model-supplied-loopback-urls-in-message-action-forwarding

Vulnerability Description

Affected Platforms (CPE)

References & Advisories

関連する脆弱性情報