CVE-2026-53839
Openclaw ≤ 2026.5.7
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-53839 is a medium-severity Incomplete Comparison with Missing Factors (CWE-1023) vulnerability in Openclaw Openclaw. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-36627
Vulnerability Data
OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted…
more
endpoints.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.3.4V6.3.5V6.1.3V6.5.7
Mitigating Controls (NIST 800-53 r5) AI
Mandating that access-control decisions apply the full set of required rules to each request structurally eliminates missing-factor comparisons.
Access enforcement requires that every authorization decision evaluate all relevant entity attributes, directly stopping incomplete comparisons from being used.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (reviews, testing, static analysis) directly prevent incomplete comparison flaws from being introduced.
Authentication decisions often rely on multi-factor comparisons; incomplete comparisons directly weaken this control.
Enforcing access policy requires complete evaluation of all relevant attributes; missing factors undermine authorization decisions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing comparison factors, yet testing is only one part of the control's scope.
Application security requirements can mandate complete multi-factor comparisons, but the control is broader than this single weakness.
Secure architecture principles can require exhaustive entity comparisons, yet the control addresses many other design concerns.
Secure coding standards can forbid incomplete comparisons, but the control covers a wide range of coding issues.