CVE-2026-53811: OpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFrom

Synopsis

A privilege escalation vulnerability exists in OpenClaw before version 2026.5.7, affecting the Matrix allowFrom feature. An authenticated attacker who can modify their display name can spoof another Matrix identity and match policy entries meant for a different account, gaining agent-level access that the operator did not intend to grant. Successful exploitation gives the attacker unauthorized permissions over resources protected by those policy entries. A patched-image rebuild at version 2026.5.7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenClaw service over the network; the AV:N vector token indicates the vulnerable endpoint is exposed to network-accessible clients.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; the attacker must be able to log in and modify their own display name, but no elevated or admin credentials are needed.

• Victim interactionNot required

  No victim action is needed; the attacker manipulates their own display name and the policy match occurs server-side without any user interaction.

• Attack complexityDetail

  Base exploit logic is straightforward (AC:L), but the AT:P token indicates a specific precondition must be met, namely that the operator has configured a Matrix allowFrom policy entry that relies on display name matching rather than a stable identity attribute.

Blast Radius

• The attacker reads data accessible to the impersonated Matrix identity, including resources the legitimate account is authorized to view.
• The attacker writes or modifies resources under the impersonated identity's agent permissions, depending on what the operator's policy grants.
• The attacker can disrupt or terminate agent operations tied to the impersonated identity, causing service-level failures for workloads that depend on that agent access.
• The scope of impact is bounded to the local OpenClaw instance (SC:N, SI:N, SA:N), so no lateral movement to adjacent systems is implied by this vector alone.