CVE-2026-53861 is an allowlist bypass (CWE-184) in OpenClaw before version 2026.5.6, in the macOS Swift exec feature. Combined POSIX inline flags can hide shell content from the check. NVD scores it 6.6 medium. Upgrade to 2026.5.6 and keep approvals on for shell flags.
What's affected
OpenClaw, an npm package, in versions up to and including 2026.5.5. The first stable patched version is 2026.5.6.
The flaw applies to the macOS Swift exec feature when it is enabled and reachable. The advisory notes that the practical impact depends on the operator's configuration and whether lower trust input can reach that path.
How to check if you're exposed
Check the installed version:
npm ls -g openclaw
npm ls openclaw
Anything at or below 2026.5.5 is affected. Then confirm whether you use the macOS exec feature and who can send requests to it.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Update OpenClaw to 2026.5.6 or later.
- Until you can update, require approval for combined shell flag forms on macOS, as the advisory advises.
- Keep channel and tool allowlists narrow.
- Do not share one Gateway between users who do not trust each other.
- Disable the affected feature when it is not needed.
Why it matters
An allowlist works only if the check sees what will really run. Shell flags can be combined into one token, for example several single letter options in a row, and a check that looks for each flag by itself can miss an inline command given that way. The record classes it as CWE-184, incomplete list of disallowed inputs.
The advisory is careful about scope. It does not change the project's trusted operator model: authenticated operators and installed plugins stay trusted. The risk appears when lower trust input can reach the feature. The record does not report exploitation and it is not in the CISA KEV catalog.
Quick check
Does this affect Linux or Windows?
The record and advisory scope it to the macOS Swift exec feature.
Is this remotely exploitable?
NVD scores it as local with user interaction. Your exposure depends on who can reach the feature.
Sources
Last reviewed: 19 October 2026.
