CVE-2026-53857CWE-290

OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy

High · published June 16, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-06-16T18:05Z
EPSS history
Timeline
  • 16 JUN 18:05Z
    OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy
    cvelistv5