CVE-2026-53849: OpenClaw < 2026.5.7 - Privilege Escalation via Mutable Discord Display Names in allowFrom

Synopsis

This is a privilege escalation vulnerability in OpenClaw, an agent-access management tool, affecting all versions before 2026.5.7. The flaw is reachable over the network and requires only a low-privilege Discord account: an attacker sets their Discord display name to match a name listed in an allowFrom policy entry, which OpenClaw then incorrectly treats as proof of identity, because it checks mutable display names instead of stable, immutable user IDs. Successful exploitation grants the attacker unauthorized agent access scoped to whatever permissions the impersonated identity holds. A patched-image rebuild at version 2026.5.7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenClaw service over the network to submit the manipulated Discord display name and trigger the flawed identity check.

• AuthenticationRequired

  The attacker must hold a valid low-privilege Discord account; anonymous access is not sufficient, but no elevated or administrative privileges are needed.

• Victim interactionNot required

  No action by a victim or administrator is needed; the attacker triggers exploitation entirely through their own requests.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker controls a Discord account; no race conditions, memory layout dependencies, or other environmental factors are involved.

Blast Radius

• The attacker reads data and resources accessible to the impersonated Discord identity, which may include sensitive agent configurations, credentials, or policy definitions.
• The attacker modifies agent state or policy entries scoped to the impersonated identity, potentially altering access controls or operational behavior within OpenClaw.
• Availability of the OpenClaw service itself is not impacted according to the CVSS vector; the attacker gains access without causing service disruption.
• The impact is contained to the vulnerable OpenClaw instance; no scope change to systems outside the affected component is indicated by the CVSS vector.