CVE-2026-53844: OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search

Published Jun 16, 2026
·
Updated

Summary

memory-wiki shared search could miss session visibility checks. In affected versions, a caller able to search shared memory could skip the session visibility guard on the affected search path.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could return memory entries that should not have been visible to that session. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.4.29.

Mitigations

limit shared memory search to trusted operators until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

Other sources

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path to retrieve memory entries that should not be visible to their session.

MITRE

Affected Software

7 affected componentsFixes available
OpenClaw OpenClaw<2026.4.29
OpenClaw Openclaw Node.js<2026.4.29
OpenClaw Openclaw Node.js=2026.4.29-beta1
OpenClaw Openclaw Node.js=2026.4.29-beta2
OpenClaw Openclaw Node.js=2026.4.29-beta3
OpenClaw Openclaw Node.js=2026.4.29-beta4
npm/openclaw<=2026.4.27
2026.4.29

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/openclaw to a version that resolves this vulnerability.

    Fixed in 2026.4.29
  2. Configuration

    Disable the memory-wiki shared search feature when it is not needed; keep disabled until the installation is upgraded to 2026.4.29.

    OpenClaw memory-wiki shared search = disabled
  3. Configuration

    Limit shared memory search so only trusted operators can perform searches until the system is patched (upgrade to 2026.4.29).

    OpenClaw shared memory search access = trusted-operators-only
  4. Configuration

    Keep channel and tool allowlists narrow (restrict channels and tools to the minimum required set).

    OpenClaw channel and tool allowlists = narrow
  5. Compensating control

    Avoid sharing one Gateway between mutually untrusted users; ensure Gateways are not shared across untrusted parties as a mitigation until systems are patched.

Event History

Jun 16, 2026
CVE Published
via MITRE·06:04 PM
Data Sourced
via MITRE·06:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeaknessAffected Software
Jun 18, 2026
Advisory Published
via GitHub·08:31 PM
Data Sourced
via GitHub·08:31 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-53844?

The severity of CVE-2026-53844 is medium with a score of 6.

2

How do I fix CVE-2026-53844?

To fix CVE-2026-53844, update your OpenClaw installation to version 2026.4.29 or later.

3

What systems are affected by CVE-2026-53844?

CVE-2026-53844 affects OpenClaw versions prior to 2026.4.29.

4

What does the vulnerability CVE-2026-53844 affect?

CVE-2026-53844 affects the session visibility check mechanism in shared memory search.

5

Can CVE-2026-53844 lead to data exposure?

Yes, CVE-2026-53844 can lead to data exposure by allowing unauthorized access to shared memory.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203