CVE-2026-53849: OpenClaw < 2026.5.7 - Privilege Escalation via Mutable Discord Display Names in allowFrom
Summary
Discord allowFrom could bind to mutable display names. In affected versions, a Discord account able to change display or global name metadata could match a policy entry through mutable display metadata.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
Impact
When the affected feature is enabled and reachable, this could receive agent access intended for another Discord identity. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
Patched Versions
The first stable patched version is 2026.5.7.
Mitigations
use stable Discord user IDs in allowlists until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
Other sources
OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.5.7 - Configuration
Replace allowFrom allowlist entries that reference Discord display or global names with stable Discord user IDs until the product is upgraded to 2026.5.7.
OpenClaw allowFrom (Discord identity allowlist) = use stable Discord user IDs - Configuration
Disable the Discord allowFrom feature when it is not needed to prevent matching on mutable display names.
OpenClaw Discord allowFrom feature = disabled - Compensating control
Keep channel and tool allowlists narrow; remove or restrict broad allowlist entries that could match mutable Discord display names.
- Compensating control
Avoid sharing one Gateway between mutually untrusted users; isolate Gateways or assign separate Gateways per trust boundary to limit exposure.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53849?
CVE-2026-53849 has a severity rating of high at 8.6.
How can I fix CVE-2026-53849?
To fix CVE-2026-53849, upgrade to OpenClaw version 2026.5.7 or later.
What types of systems are affected by CVE-2026-53849?
CVE-2026-53849 affects systems using OpenClaw Node.js and OpenClaw applications.
What is the impact of CVE-2026-53849?
CVE-2026-53849 allows for privilege escalation through mutable display names in the allowFrom feature.
Can CVE-2026-53849 be exploited remotely?
Yes, CVE-2026-53849 can be exploited remotely by an attacker with access to alter display metadata.