CVE-2026-53860: OpenClaw sender allowlist bypass

CISO Take

OpenClaw before version 2026.5.7 contains an authorization flaw in its BlueBubbles messaging integration that allows any conversation participant to spoof membership in the agent's configured sender allowlist by manipulating mutable conversation-level metadata instead of verifiable sender identity. For security teams running OpenClaw-based AI agents, this means an untrusted party sharing a BlueBubbles thread can issue commands to the agent as if they were an authorized operator — the actual blast radius depends on what tools and capabilities the agent has been granted. EPSS data is unavailable and there is no public exploit or KEV listing, but the attack requires only low privileges and no user interaction once inside a shared conversation. Upgrade to OpenClaw 2026.5.7 immediately; as a short-term workaround, restrict all BlueBubbles conversations that include the agent to explicitly trusted, invite-only participants and audit recent agent logs for unexpected sender activity.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

CVSS 4.2 (Medium) with network attack vector and high complexity reflects the prerequisite of being a conversation participant and understanding mutable metadata fields. However, in practice, any participant in an open or semi-open BlueBubbles group can exploit this without specialized skills once they identify the relevant metadata structure. No KEV listing, EPSS unavailable, and no public exploit reduce near-term exploitation probability. Primary risk is unauthorized AI agent command execution, whose severity scales directly with the agent's granted capabilities — ranging from low-impact information disclosure to high-impact automated actions if the agent is connected to sensitive enterprise tools, APIs, or data stores.

How does the attack unfold?

Reconnaissance

Attacker joins or is already present in a BlueBubbles conversation group and probes mutable conversation metadata fields to identify which identifiers OpenClaw evaluates during its sender allowlist check.

AML.T0084.002

Identity Spoofing

Attacker modifies a mutable conversation-level metadata field (e.g., display name or group identifier) to match an entry in the OpenClaw sender allowlist, forging apparent authorized-sender identity.

AML.T0049

Authorization Bypass

OpenClaw evaluates the forged metadata against its allowlist and incorrectly grants the attacker sender-level authorization due to reliance on untrusted conversation identifiers rather than stable sender credentials (CWE-807/CWE-863).

AML.T0107

Unauthorized Agent Control

Attacker issues arbitrary commands to the OpenClaw agent with authorized-sender permissions, invoking connected tools to retrieve data, execute actions, or manipulate automated agent workflows.

AML.T0053

Reconnaissance

Attacker joins or is already present in a BlueBubbles conversation group and probes mutable conversation metadata fields to identify which identifiers OpenClaw evaluates during its sender allowlist check.

AML.T0084.002

Identity Spoofing

Attacker modifies a mutable conversation-level metadata field (e.g., display name or group identifier) to match an entry in the OpenClaw sender allowlist, forging apparent authorized-sender identity.

AML.T0049

Authorization Bypass

OpenClaw evaluates the forged metadata against its allowlist and incorrectly grants the attacker sender-level authorization due to reliance on untrusted conversation identifiers rather than stable sender credentials (CWE-807/CWE-863).

AML.T0107

Unauthorized Agent Control

Attacker issues arbitrary commands to the OpenClaw agent with authorized-sender permissions, invoking connected tools to retrieve data, execute actions, or manipulate automated agent workflows.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 61% patched ~0d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.2 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

1 step

1) Patch: upgrade OpenClaw to 2026.5.7 or later, which fixes sender identity verification to use stable, cryptographically-backed identifiers instead of mutable conversation metadata. 2) Workaround: until patched, restrict all BlueBubbles conversations interfacing with the agent to invitation-only groups with explicitly vetted participants; remove untrusted or unknown members immediately. 3) Detection: review agent command and audit logs for instructions originating from senders not in your known-good allowlist; correlate with conversation participant join events for anomalies. 4) Scope reduction: apply least-privilege to agent tool access and disable or restrict high-impact tool integrations until the patch is deployed.

How is it classified?

Auth Bypass Code Execution Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084.002 - Activation Triggers AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.2.6 - AI System Operation — Access Control

NIST AI RMF

GOVERN 6.2 - Policies and procedures are in place to address AI risks

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-53860?

OpenClaw before version 2026.5.7 contains an authorization flaw in its BlueBubbles messaging integration that allows any conversation participant to spoof membership in the agent's configured sender allowlist by manipulating mutable conversation-level metadata instead of verifiable sender identity. For security teams running OpenClaw-based AI agents, this means an untrusted party sharing a BlueBubbles thread can issue commands to the agent as if they were an authorized operator — the actual blast radius depends on what tools and capabilities the agent has been granted. EPSS data is unavailable and there is no public exploit or KEV listing, but the attack requires only low privileges and no user interaction once inside a shared conversation. Upgrade to OpenClaw 2026.5.7 immediately; as a short-term workaround, restrict all BlueBubbles conversations that include the agent to explicitly trusted, invite-only participants and audit recent agent logs for unexpected sender activity.

Is CVE-2026-53860 actively exploited?

No confirmed active exploitation of CVE-2026-53860 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-53860?

1) Patch: upgrade OpenClaw to 2026.5.7 or later, which fixes sender identity verification to use stable, cryptographically-backed identifiers instead of mutable conversation metadata. 2) Workaround: until patched, restrict all BlueBubbles conversations interfacing with the agent to invitation-only groups with explicitly vetted participants; remove untrusted or unknown members immediately. 3) Detection: review agent command and audit logs for instructions originating from senders not in your known-good allowlist; correlate with conversation participant join events for anomalies. 4) Scope reduction: apply least-privilege to agent tool access and disable or restrict high-impact tool integrations until the patch is deployed.

What systems are affected by CVE-2026-53860?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, messaging-integrated AI agents, chatbot and automation pipelines.

What is the CVSS score for CVE-2026-53860?

CVE-2026-53860 has a CVSS v3.1 base score of 4.2 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

agent frameworksmessaging-integrated AI agentschatbot and automation pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084.002 Activation Triggers

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 6.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity. Attackers can influence conversation-level identifiers to receive agent responses intended for configured senders, potentially bypassing access controls.

Exploitation Scenario

An attacker with access to a BlueBubbles group conversation that includes an OpenClaw agent probes conversation metadata to identify mutable fields — such as display names, group identifiers, or thread labels — that the agent evaluates during its allowlist check. The attacker updates one of these fields to mirror a value associated with an authorized sender. When the attacker subsequently sends a message, OpenClaw evaluates the forged metadata against its allowlist and incorrectly grants sender-level authorization. The attacker can then issue arbitrary commands to the agent — instructing it to retrieve sensitive data, invoke external APIs, execute file operations, or escalate further — without ever possessing the legitimate sender's credentials or cryptographic identity material.

Weaknesses (CWE)

CWE-807 Reliance on Untrusted Inputs in a Security Decision Primary CWE-863 Incorrect Authorization Primary

CWE-807 — Reliance on Untrusted Inputs in a Security Decision: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

[Architecture and Design] Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.

Source: MITRE CWE corpus.