CVE-2026-53860CWE-807CWE-863

OpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubbles

Low · published June 16, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity. Attackers can influence conversation-level identifiers to receive agent responses intended for configured senders, potentially bypassing access controls.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00231 · 13.1th percentile
Weaknesses
CWE-807 · Reliance on Untrusted Inputs in a Security Decision; CWE-863 · Incorrect Authorization
Published
2026-06-16T18:05Z
EPSS history
Timeline
  • 16 JUN 18:05Z
    OpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubbles
    cvelistv5