{"document":{"category":"csaf_vex","csaf_version":"2.0","title":"CVE-2026-53857: OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy","publisher":{"category":"vendor","name":"HarborGuard Database","namespace":"https://database.harborguard.co"},"tracking":{"id":"CVE-2026-53857","status":"final","version":"1","initial_release_date":"2026-06-16T18:05:05.109Z","current_release_date":"2026-06-16T18:55:30.841Z","revision_history":[{"date":"2026-06-16T18:05:05.109Z","number":"1","summary":"Initial machine-readable export from HarborGuard."}]},"distribution":{"tlp":{"label":"WHITE"},"text":"Public CVE data; freely redistributable."},"notes":[{"category":"description","text":"OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.","title":"CVE description"}],"references":[{"category":"self","summary":"CVE-2026-53857 on HarborGuard Database","url":"https://database.harborguard.co/cve/CVE-2026-53857"},{"category":"external","summary":"CVE Record","url":"https://www.cve.org/CVERecord?id=CVE-2026-53857"},{"category":"external","summary":"GitHub Security Advisory (GHSA-8c59-hr4w-qg69)","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8c59-hr4w-qg69"},{"category":"external","summary":"VulnCheck Advisory: OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy","url":"https://www.vulncheck.com/advisories/openclaw-mutable-display-name-binding-in-zalo-allowfrom-policy"}]},"product_tree":{"branches":[{"category":"vendor","name":"OpenClaw","branches":[{"category":"product_name","name":"OpenClaw","branches":[{"category":"product_version_range","name":"<2026.5.3","product":{"name":"OpenClaw OpenClaw <2026.5.3","product_id":"CSAFPID-1","product_identification_helper":{"cpe":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"2026.5.3","product":{"name":"OpenClaw OpenClaw 2026.5.3","product_id":"CSAFPID-2","product_identification_helper":{"cpe":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*"}}}]}]}]},"vulnerabilities":[{"cve":"CVE-2026-53857","title":"OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy","notes":[{"category":"description","text":"OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.","title":"CVE description"}],"product_status":{"known_affected":["CSAFPID-1"],"fixed":["CSAFPID-2"]},"scores":[{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","baseScore":8.6,"baseSeverity":"HIGH"},"products":["CSAFPID-1"]}],"remediations":[{"category":"vendor_fix","details":"Update to a fixed version: 2026.5.3.","product_ids":["CSAFPID-1"]}]}]}