{"metadata": {"vulnerability": "cve-2026-53860", "count": 30, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 22}}, "data": [{"timestamp": "2026-05-28T00:00:00Z", "date_only": false, "value": "2026-05-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-53860", "field": "containers.cna.datePublic"}, {"timestamp": "2026-05-28T22:00:00Z", "date_only": false, "value": "2026-05-28T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-05-28T22:00:00Z", "date_only": false, "value": "2026-05-28T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-05-28T22:00:00Z", "date_only": false, "value": "2026-05-28T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-05-31T22:00:00Z", "date_only": false, "value": "2026-05-31T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-06-10T21:22:34.480Z", "date_only": false, "value": "2026-06-10T21:22:34.480Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-53860", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-11T22:00:00Z", "date_only": false, "value": "2026-06-11T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-06-14T22:00:00Z", "date_only": false, "value": "2026-06-14T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-06-16T18:05:07.218Z", "date_only": false, "value": "2026-06-16T18:05:07.218Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-53860", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-06-16T18:05:07.218Z", "date_only": false, "value": "2026-06-16T18:05:07.218Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-53860", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-16T19:17:03Z", "date_only": false, "value": "2026-06-16T19:17:03Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8HJ2-W4C9-FJFQ", "record": "GHSA-8HJ2-W4C9-FJFQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-16T19:17:03.573Z", "date_only": false, "value": "2026-06-16T19:17:03.573", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-53860", "record": "FKIE_CVE-2026-53860", "field": "published"}, {"timestamp": "2026-06-16T19:33:29.631Z", "date_only": false, "value": "2026-06-16T19:33:29.631823Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-53860", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-16T19:33:29.631Z", "date_only": false, "value": "2026-06-16T19:33:29.631823Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-53860", "record": "FKIE_CVE-2026-53860", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-16T19:33:35.725Z", "date_only": false, "value": "2026-06-16T19:33:35.725Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-53860", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-16T19:33:35.725Z", "date_only": false, "value": "2026-06-16T19:33:35.725Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-53860", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-16T21:32:00Z", "date_only": false, "value": "2026-06-16T21:32:00Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8HJ2-W4C9-FJFQ", "record": "GHSA-8HJ2-W4C9-FJFQ", "field": "published"}, {"timestamp": "2026-06-16T22:00:00Z", "date_only": false, "value": "2026-06-16T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-06-16T22:00:00Z", "date_only": false, "value": "2026-06-16T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-06-17T08:39:59.506Z", "date_only": false, "value": "2026-06-17T08:39:59.506+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1738", "record": "WID-SEC-W-2026-1738", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-17T22:23:25.277Z", "date_only": false, "value": "2026-06-17T22:23:25.277", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-53860", "record": "FKIE_CVE-2026-53860", "field": "lastModified"}, {"timestamp": "2026-06-18T20:32:05Z", "date_only": false, "value": "2026-06-18T20:32:05Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8HJ2-W4C9-FJFQ", "record": "GHSA-8HJ2-W4C9-FJFQ", "field": "modified"}, {"timestamp": "2026-06-18T20:32:05Z", "date_only": false, "value": "2026-06-18T20:32:05Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-8HJ2-W4C9-FJFQ", "record": "GHSA-8HJ2-W4C9-FJFQ", "field": "withdrawn"}, {"timestamp": "2026-06-18T20:32:21Z", "date_only": false, "value": "2026-06-18T20:32:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8J37-5W68-WJ2G", "record": "GHSA-8J37-5W68-WJ2G", "field": "published"}, {"timestamp": "2026-06-18T20:32:21Z", "date_only": false, "value": "2026-06-18T20:32:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8J37-5W68-WJ2G", "record": "GHSA-8J37-5W68-WJ2G", "field": "modified"}, {"timestamp": "2026-06-19T08:41:59Z", "date_only": false, "value": "2026-06-19T08:41:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/9745ea7f614dc3dd47451c872d75fca1", "record": "CVE-2026-53860", "field": "creation_timestamp", "uuid": "608deaff-fce9-406e-b0ea-a97720d5733f", "content": "# CVE-2026-53860: CVE-2026-53860: Sender Policy Bypass in OpenClaw BlueBubbles Integration\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-06-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53860\n\n## Summary\nCVE-2026-53860 details an authorization bypass in the OpenClaw AI gateway's BlueBubbles integration. The vulnerability arises because the sender policy check validates mutable conversation-level metadata rather than verified, stable sender identities. This allows unauthorized group chat participants to manipulate metadata, match allowlist rules, and run unauthorized AI agent actions.\n\n## TL;DR\nA vulnerability in OpenClaw's BlueBubbles integration allows unauthorized participants to bypass sender validation by manipulating conversation metadata. Upgrading to version 2026.5.7 resolves the flaw by enforcing checks on stable sender identities.\n\n## Technical Details\n\n- **CWE ID**: CWE-807 / CWE-863\n- **Attack Vector**: Network\n- **CVSS v3.1**: 4.2 (Medium)\n- **EPSS Score**: 0.00136 (Percentile: 3.38%)\n- **Impact**: Sender Policy Bypass & Unauthorized Command Execution\n- **Exploit Status**: No public PoC or active exploitation\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenClaw < 2026.5.7\n- **openclaw**: < 2026.5.7 (Fixed in: `2026.5.7`)\n\n## Mitigation\n\n- Upgrade to OpenClaw version 2026.5.7 or later\n- Strictly use stable, immutable sender identifiers (phone numbers, iCloud emails) in policies\n- Restrict permissions to alter group chat metadata within BlueBubbles\n- Limit the permissions and tools accessible by the AI agent\n\n**Remediation Steps:**\n1. Verify current OpenClaw version using the package manager\n2. Update the openclaw package to version 2026.5.7 via npm or your deployment pipeline\n3. Inspect existing configuration files to replace conversation-level allowlist rules with verified sender handles\n4. Restart the OpenClaw gateway service to apply the updated configuration\n\n## References\n\n- [GitHub Security Advisory GHSA-8j37-5w68-wj2g](https://github.com/openclaw/openclaw/security/advisories/GHSA-8j37-5w68-wj2g)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/openclaw-sender-policy-bypass-via-mutable-conversation-identifiers-in-bluebubbles)\n- [OpenClaw GitHub Repository](https://github.com/openclaw/openclaw)\n- [NVD CVE-2026-53860](https://nvd.nist.gov/vuln/detail/CVE-2026-53860)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53860) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/9745ea7f614dc3dd47451c872d75fca1"}, {"timestamp": "2026-06-22T00:00:00Z", "date_only": true, "value": "2026-06-22", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2026-26890", "record": "CNVD-2026-26890", "field": "submitTime"}, {"timestamp": "2026-07-10T00:00:00Z", "date_only": true, "value": "2026-07-10", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2026-26890", "record": "CNVD-2026-26890", "field": "openTime"}, {"timestamp": "2026-08-13T17:21:32Z", "date_only": false, "value": "2026-08-13T17:21:32Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-OPENCLAW-CLI-CVE-2026-53860", "record": "BREW-OPENCLAW-CLI-CVE-2026-53860", "field": "published"}, {"timestamp": "2026-10-13T09:08:52Z", "date_only": false, "value": "2026-10-13T09:08:52Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-OPENCLAW-CLI-CVE-2026-53860", "record": "BREW-OPENCLAW-CLI-CVE-2026-53860", "field": "modified"}]}