CVE-2026-53860: OpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubbles
Summary
BlueBubbles sender policy could match mutable conversation identifiers. In affected versions, a participant able to influence conversation-level identifiers could match an allowlist entry through conversation metadata rather than a stable sender identity.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
Impact
When the affected feature is enabled and reachable, this could receive agent responses that should have been limited to a configured sender. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
Patched Versions
The first stable patched version is 2026.5.7.
Mitigations
prefer stable sender identifiers and keep BlueBubbles groups restricted until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
Other sources
OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity. Attackers can influence conversation-level identifiers to receive agent responses intended for configured senders, potentially bypassing access controls.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.5.7 - Configuration
Disable the BlueBubbles feature when it is not required to prevent sender-policy bypass via mutable conversation identifiers.
OpenClaw BlueBubbles feature enabled = false - Configuration
Configure the BlueBubbles sender policy to match stable sender identities rather than mutable conversation-level identifiers (do not allow matching based on conversation metadata).
BlueBubbles sender policy match_on_conversation_metadata = false - Configuration
Keep channel and tool allowlists narrow — limit entries to explicit, stable channel and tool identifiers only.
OpenClaw allowlists channel_and_tool_allowlist = restrict_to_explicit_stable_ids - Compensating control
Avoid sharing a single Gateway instance between mutually untrusted users; deploy separate Gateways per trust boundary or restrict Gateway access to trusted administrators and network segments.
- Compensating control
Restrict BlueBubbles groups to trusted participants and prevent lower-trust input from reaching BlueBubbles paths until systems are upgraded to 2026.5.7.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53860?
The severity of CVE-2026-53860 is rated as medium with a CVSS score of 4.2.
How do I fix CVE-2026-53860?
To fix CVE-2026-53860, upgrade OpenClaw to version 2026.5.7 or later.
What type of vulnerability is CVE-2026-53860?
CVE-2026-53860 is a sender policy bypass vulnerability affecting the BlueBubbles feature in OpenClaw.
What are the potential impacts of CVE-2026-53860?
CVE-2026-53860 can allow attackers to receive agent responses intended for other users by manipulating conversation metadata.
Which software is affected by CVE-2026-53860?
CVE-2026-53860 affects OpenClaw versions prior to 2026.5.7.