CVE-2026-53844: OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search
Summary
memory-wiki shared search could miss session visibility checks. In affected versions, a caller able to search shared memory could skip the session visibility guard on the affected search path.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
Impact
When the affected feature is enabled and reachable, this could return memory entries that should not have been visible to that session. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
Patched Versions
The first stable patched version is 2026.4.29.
Mitigations
limit shared memory search to trusted operators until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
Other sources
OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path to retrieve memory entries that should not be visible to their session.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.4.29 - Configuration
Disable the memory-wiki shared search feature when it is not needed; keep disabled until the installation is upgraded to 2026.4.29.
OpenClaw memory-wiki shared search = disabled - Configuration
Limit shared memory search so only trusted operators can perform searches until the system is patched (upgrade to 2026.4.29).
OpenClaw shared memory search access = trusted-operators-only - Configuration
Keep channel and tool allowlists narrow (restrict channels and tools to the minimum required set).
OpenClaw channel and tool allowlists = narrow - Compensating control
Avoid sharing one Gateway between mutually untrusted users; ensure Gateways are not shared across untrusted parties as a mitigation until systems are patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53844?
The severity of CVE-2026-53844 is medium with a score of 6.
How do I fix CVE-2026-53844?
To fix CVE-2026-53844, update your OpenClaw installation to version 2026.4.29 or later.
What systems are affected by CVE-2026-53844?
CVE-2026-53844 affects OpenClaw versions prior to 2026.4.29.
What does the vulnerability CVE-2026-53844 affect?
CVE-2026-53844 affects the session visibility check mechanism in shared memory search.
Can CVE-2026-53844 lead to data exposure?
Yes, CVE-2026-53844 can lead to data exposure by allowing unauthorized access to shared memory.