CVE-2026-53839: Openclaw

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.

Affected products

• Openclaw Openclaw: before 2026.5.7 (fixed in 2026.5.7)

Published 2026-06-12. Last modified 2026-10-08.