CVE-2026-53808 | BDVDB-2026-339821 Detail

Description#

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true despite approvalPolicy: pending configuration. Attackers can exploit this by reaching the affected apply path to apply workshop changes before the expected approval step, potentially modifying configurations without proper authorization.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-06-11Record published in the CVE List.
2. Version 22026-06-23Most recent update recorded in the CVE List.