CVE-2026-53816: OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node

Synopsis

This is an insufficient provenance validation vulnerability in OpenClaw, the node event handling component. A remote attacker with administrative credentials on a paired node can send crafted node.event messages to the gateway over the network, bypassing the system.run authorization check that should gate exec lifecycle events. Successful exploitation gives the attacker full read, write, and availability impact on the vulnerable component, exposing capabilities the reduced node surface is not supposed to provide. A patched-image rebuild at version 2026.5.18 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenClaw gateway service over the network to deliver crafted node.event messages (AV:N).

• AuthenticationRequired

  The attacker must control or compromise a paired node that holds admin-level credentials; a high-privilege account is required to interact with the gateway event path (PR:H).

• Victim interactionNot required

  No user or operator action is needed to trigger the vulnerability; the attacker sends the malicious message directly (UI:N).

• Attack complexityDetail

  Exploit conditions are reliable and free of environmental prerequisites; no race conditions or special memory layout are required (AC:L, AT:N).

Blast Radius

• The attacker reads data the paired node surface should not expose, including session state and capability metadata tied to the targeted exec session (VC:H).
• The attacker writes to or modifies persisted session or capability state within the affected component, steering target sessions into unauthorized exec-event paths (VI:H).
• The attacker can crash or disrupt the availability of the affected OpenClaw component for the duration of the attack (VA:H).
• Impact is contained to the vulnerable component; the CVSS v4.0 vector records no subsequent-system confidentiality, integrity, or availability impact (SC:N/SI:N/SA:N).