Openclaw cli: OpenClaw: Tool group policy callers could accept unvalidated group IDs (CVE-2026-53863)
Description
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.4.25 contain a vulnerability where tool group policy callers could accept unvalidated group IDs. This may cause the application of incorrect group-policy decisions for tool invocations when the affected feature is enabled and accessible. The vulnerability does not alter the trusted-operator model of OpenClaw. A patch is available starting with version 2026.4.25. Until patched, it is recommended to avoid exposing group-policy controlled tools to untrusted senders and to apply configuration hardening measures.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenClaw CLI has a vulnerability (CVE-2026-53863) in which callers supplying group IDs to the policy resolver can provide unvalidated group IDs. This can lead to incorrect group-policy decisions being applied during tool invocations if the affected feature is enabled and reachable. The vulnerability is scoped to the named feature and does not affect the overall trusted-operator model. The first stable patched version is 2026.4.25.
Potential Impact
If exploited, this vulnerability could cause the application of incorrect group-policy decisions for tool invocations, potentially allowing unauthorized or unintended policy outcomes. The practical impact depends on the operator's configuration and whether untrusted inputs can reach the affected policy resolution path.
Mitigation Recommendations
A patch is available in version 2026.4.25. Until systems are updated, avoid exposing group-policy controlled tools to untrusted senders. Additionally, narrow channel and tool allowlists, avoid sharing a Gateway between mutually untrusted users, and disable the affected feature when not needed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-53863
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac2458912601ec6a31640ad
Added to database: 10/04/2026, 12:24:41 UTC
Last enriched: 10/04/2026, 12:34:16 UTC
Last updated: 10/04/2026, 16:08:39 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.