CVE-2026-53839: OpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation
OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.5.7 - Compensating control
Ensure retry endpoint validation uses exact hostname matching rather than hostname prefix matching (to prevent crafted hostname prefixes from bypassing trusted endpoint checks).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53839?
The severity of CVE-2026-53839 is rated as medium with a score of 6.
How do I fix CVE-2026-53839?
To fix CVE-2026-53839, update OpenClaw to version 2026.5.7 or later.
What are the potential impacts of exploiting CVE-2026-53839?
Exploiting CVE-2026-53839 may allow attackers to send authentication material to untrusted endpoints by crafting a matching hostname prefix.
Which versions of OpenClaw are affected by CVE-2026-53839?
OpenClaw versions prior to 2026.5.7 are affected by CVE-2026-53839.
Is there a workaround for CVE-2026-53839 if I cannot upgrade?
Currently, there are no documented workarounds for CVE-2026-53839; upgrading is the recommended solution.