CVE-2026-53844
Description
OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path to retrieve memory entries that should not be visible to their session.
Summary dbcve.org
OpenClaw before 2026.4.29 contains a session visibility check bypass in shared memory search that allows authenticated attackers to circumvent session isolation guards and retrieve memory entries belonging to other sessions. The vulnerability exists in the search path logic where session visibility validation is improperly enforced or missing.
Mitigation
Upgrade to OpenClaw version 2026.4.29 or later to obtain the patched session visibility enforcement in shared memory operations. If upgrade is not immediately possible, review shared memory access controls and implement explicit session context validation before returning any memory entries.