CVE-2026-53808: OpenClaw Approval Policy Bypass in Skill Workshop Apply Flow

Technical summary

CVE-2026-53808 is an authorization bypass in OpenClaw's Skill Workshop apply flow. The vulnerability exists because the system fails to properly enforce the approvalPolicy: pending configuration when agent tool calls set apply: true on the apply endpoint. An unauthenticated attacker can reach the affected apply path and cause workshop changes to be committed before the expected approval gate. The root cause relates to insufficient authorization checks (CWE-863: Incorrect Authorization) in the apply flow logic, allowing attackers to circumvent approval workflows that are otherwise configured in the system.

Business impact

This vulnerability enables unauthorized modification of OpenClaw workshop configurations in environments where approval workflows are in place. The security control designed to enforce review and authorization before deploying changes can be bypassed, creating a window for unauthorized or malicious configuration changes. For regulated organizations relying on OpenClaw for agent tool management, this could violate compliance requirements around change management. For all users, it undermines trust in the approval workflow and could allow misuse of workshop features if an attacker gains access to the apply endpoint.

Affected systems

OpenClaw versions before 2026.5.6 are vulnerable. This includes all prior release branches. Organizations running OpenClaw in production should check their version immediately. The vulnerability is specific to the Skill Workshop apply flow within the OpenClaw platform.

Exploitability

Exploitability is moderate. The attack requires network access to reach the apply endpoint and requires user interaction (such as following a crafted link or being directed to a malicious request). No authentication is required to exploit the vulnerability, and no special technical privileges are needed. An attacker could craft a request targeting the workshop apply flow and trick a user into triggering it, or directly reach the endpoint if it is exposed. The CVSS vector AV:N/AC:L/UI:R reflects this profile: network-accessible, low attack complexity, and user interaction required.

Remediation

Upgrade OpenClaw to version 2026.5.6 or later, which includes proper authorization checks for the apply endpoint and enforces the approvalPolicy: pending configuration. Organizations should verify the fix is applied by checking version numbers and reviewing the Skill Workshop apply flow behavior after patching. Until patching is complete, monitor access to the workshop apply endpoint and restrict which users can trigger workflow changes.

Patch guidance

Download and deploy OpenClaw 2026.5.6 or any later release available from the vendor. Apply the patch to all instances running the Skill Workshop feature. The patch addresses the authorization check failure by validating approvalPolicy: pending before allowing apply: true to take effect. Test the patch in a non-production environment first to confirm approval workflows are re-enforced as expected. Verify that any pending approvals are no longer bypassed after the update.

Detection guidance

Monitor OpenClaw logs for direct calls to the apply endpoint in the Skill Workshop flow, particularly those originating from unexpected sources or made without corresponding approval records. Look for apply: true requests that lack a matching approval_workflow_completed entry. Alert on any workshop configuration changes that bypass the approval log. If your environment logs agent tool calls, flag any tool invocations that directly set apply: true without prior authorization. Review access patterns to the apply path and cross-reference them against your approval audit trail.

Why prioritize this

Although this is rated MEDIUM severity (CVSS 6.5), it directly undermines a critical control—approval workflows. In environments where approval policies are business-critical for compliance or security, this vulnerability represents a significant control failure that should be patched promptly. Organizations heavily reliant on OpenClaw for agent tool governance should treat this as high-priority. For others, it remains important but not critical.

Risk score, explained

The CVSS 6.5 MEDIUM score reflects the vulnerability's network accessibility, low attack complexity, and requirement for user interaction. The impact is integrity-focused (I:H)—unauthorized configuration changes—with no impact on confidentiality or availability. The score appropriately captures the moderate threat: the vulnerability is easily reachable but requires user interaction and is limited to unauthorized modifications rather than data exposure or service disruption. Organizations with strict change management requirements may rate this higher in their own risk assessments.

Frequently asked questions