CVE-2026-53809: OpenClaw: Embedded runner policy could be confused by provider aliases

The embedded runner applies a tool policy per model provider. In affected versions, the policy lookup used the name in the request. When the request used an alias for a provider, the policy was compared with the alias and not with the canonical provider, so a rule written for the canonical name did not match. The request then reached bundled tools outside the intended policy. This is incorrect authorization (CWE-863).

The attacker needs low privileges and local reach to the runner, as the vectors state. They must be able to choose or influence the provider name in a request, for example through configuration or a request parameter. The gain is limited: the CVSS vectors score low integrity impact and no confidentiality or availability impact. The practical result is access to bundled tools that policy meant to deny for that provider.

The advisory keeps the trusted-operator model unchanged and says real impact depends on the configuration and on whether lower-trust input can reach the path. The sources do not name the aliases or the tools.

The npm package openclaw at 2026.4.24 and earlier, where the embedded runner's per-provider tool policy is in use and requests can route through provider aliases.

npm ls openclaw

Use npm ls -g openclaw for a global install. Versions up to 2026.4.24 are affected.

Upgrade to [email protected], the first stable patched version:

npm install [email protected]

Until then, the advisory says to avoid provider alias routing for embedded runner tool policy. It also advises narrow channel and tool allowlists, not sharing one Gateway between mutually untrusted users, and disabling the feature when you do not need it.

List the provider aliases defined in your OpenClaw configuration and check whether any embedded runner tool policy is written against a canonical provider name only. Review runner logs for tool calls made under an aliased provider that your policy should have denied. The sources give no log line for this flaw.

Summary

Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could select bundled tool access outside the intended provider policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.4.25.

Mitigations

Avoid provider alias routing for embedded runner tool policy until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.