CVE-2026-53860
MEDIUM
NVD
CVSS Score
4.2
Severity
MEDIUM
Published
Jun 16, 2026
Vendor
unknown
Description
OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity. Attackers can influence conversation-level identifiers to receive agent responses intended for configured senders, potentially bypassing access controls.